Cross-Site Scripting in Lightbox with PhotoSwipe Plugin Affects WordPress
CVE-2026-14833
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 31 July 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14833?
The Lightbox with PhotoSwipe plugin for WordPress, prior to version 5.9.0, introduces a security flaw that fails to properly sanitize or escape link data attributes in the image lightbox caption. This oversight permits users with author-level access or higher, who typically lack the unfiltered_html capability, to inject malicious JavaScript. When a visitor or administrator interacts with the lightbox, the stored JavaScript can execute, potentially compromising website security and user data.
Affected Version(s)
Lightbox with PhotoSwipe 0 < 5.9.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.