Firelight Lightbox CVE-2026-118438

Requires an authenticated account with contributor-level capabilities or higher on the target WordPress site (so sites that do not grant untrusted users contributor access are not exposed), plus the plugin's failure to escape image attribute values before processing them in the browser. Exploitation is not self-contained: a second, typically higher-privileged user must view or preview the attacker-authored content for the injected script to execute (UI:R). Limiting factors are therefore the presence of contributor-or-above accounts, the multi-author/review workflow needed to trigger victim interaction, and installation of an affected version (before 2.3.24).

This is a moderate, authenticated stored cross-site scripting issue (CWE-79) that does not warrant emergency treatment but should be remediated on a normal patch cycle. The signals are largely consistent on the low-urgency side: SSVC reports Exploitation 'none' and Automatable 'no', EPSS is only 0.16% (6th percentile), and the vulnerability is not on the CISA KEV list, so there is no evidence of active exploitation - the vuln.today 'this_month' priority aligns with this. The one elevating factor is SSVC Technical Impact 'total' and the provided CVSS 6.8 vector's C:H/I:H/A:H, reflecting that injected script runs in the browser of a higher-privileged victim (e.g., an editor or admin who views/previews the content), which can lead to account or site takeover. A key conflict must be flagged: the CVSS vector states PR:H (high privileges), but the description says exploitation requires only 'contributor-level access and above' - contributor is a low-privilege authenticated role, so PR:L is the more accurate reading and the published vector likely overstates the privilege barrier. The practical barrier here is not privilege height but the need for a victim to view/preview the attacker's content (UI:R) and for the site to accept contributor-level accounts at all. Net: a real but not urgent issue, primarily relevant to multi-author WordPress sites.

On a multi-author WordPress site running Firelight Lightbox before 2.3.24, a malicious or compromised contributor crafts a post whose image attribute values contain unescaped script. When an editor or administrator later views or previews that content, the script executes in their authenticated browser session, enabling cookie/session theft or actions on their behalf. No public exploit is identified at time of analysis, and exploitation requires the victim to open the attacker-supplied content.