Stored Cross-Site Scripting in Firelight Lightbox Plugin for WordPress
CVE-2026-118165
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 30 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-118165?
The Firelight Lightbox WordPress plugin, prior to version 2.3.23, is vulnerable to Stored Cross-Site Scripting (XSS) due to inadequate URL escaping. This vulnerability allows users with as little as Contributor privileges to craft malicious links that, when clicked by others, can execute harmful scripts in their browsers. Such exploits may compromise user sessions and lead to unauthorized actions, necessitating immediate updates to the plugin to mitigate the risk.
Affected Version(s)
Firelight Lightbox 0 < 2.3.23
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.