Stored Cross-Site Scripting Vulnerability in LightPress Lightbox Plugin for WordPress

CVE-2026-4379

What is CVE-2026-4379?

The LightPress Lightbox plugin for WordPress contains a vulnerability that allows authenticated attackers to perform Stored Cross-Site Scripting. This occurs through manipulation of the group attribute in the [gallery] shortcode. The vulnerability exists due to insufficient escaping of user input, enabling attackers with Contributor-level permissions or higher to inject malicious scripts into web pages. This compromised content would execute whenever an unsuspecting user visits the affected page, potentially leading to unauthorized access and data breaches.

References