Stored DOM-Based Cross-Site Scripting Vulnerability in FooBox Plugin for WordPress

CVE-2026-120687

What is CVE-2026-120687?

The FooBox plugin for WordPress contains a vulnerability that allows for Stored DOM-Based Cross-Site Scripting through inadequate input validation in the 'img alt attribute inside .wp-caption container' parameter. This flaw affects all versions leading up to and including 2.8.7, enabling unauthenticated users to inject harmful web scripts into pages. The issue is particularly exploitable when bbPress is active, as its filters can permit the injection of malicious scripts that may evade typical sanitization procedures. To exploit this vulnerability, certain conditions must be met, including appropriate user access levels, configuration of public forums, and existing approved topics. Proper sanitization and output escaping could mitigate this risk effectively.

References