What is the CVSS score of CVE-2026-1430?

CVE-2026-1430 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wp Lightbox 2 are affected by CVE-2026-1430?

Organizations using WP Lightbox 2 WordPress should be aware of moderate risk from CVE-2026-1430 rated CVSS 4.8. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2026-1430?

Yes, a public proof-of-concept exploit is available for CVE-2026-1430. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-1430?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Wp Lightbox 2 CVE-2026-1430

EUVD-2026-16122 MEDIUM

2026-03-26 WPScan

WordPress XSS Wp Lightbox 2 Unknown

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

3.0.7

PoC Detected

Mar 26, 2026 - 15:13 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 06:30 euvd

EUVD-2026-16122

Analysis Generated

Mar 26, 2026 - 06:30 vuln.today

CVE Published

Mar 26, 2026 - 06:00 nvd

MEDIUM 4.8

DescriptionCVE.org

The WP Lightbox 2 WordPress plugin before 3.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

AnalysisAI

WP Lightbox 2 WordPress plugin before version 3.0.7 contains a Stored Cross-Site Scripting (XSS) vulnerability in its settings due to insufficient input sanitization and output escaping. High-privilege users, particularly administrators, can inject malicious JavaScript that persists in the database and executes in the browsers of other users, even in multisite installations where the unfiltered_html capability is restricted. A publicly available proof-of-concept demonstrates active exploitation potential, making this a practical threat in WordPress environments.

Technical ContextAI

The vulnerability stems from improper handling of user input in the WP Lightbox 2 plugin's settings storage mechanism. The root cause is classified under improper neutralization of input during web page generation (CWE-79: Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting or XSS). The affected product is identified via CPE cpe:2.3:a:unknown:wp_lightbox_2:*:*:*:*:*:*:*:*, indicating all versions before 3.0.7 are vulnerable. WordPress plugins typically handle settings through the wp_options table; this plugin fails to properly escape data when rendering those settings in the admin interface or frontend display, allowing script injection through unfiltered input fields.

RemediationAI

Update WP Lightbox 2 to version 3.0.7 or later immediately. This patch release implements proper input sanitization (using wp_kses_post or equivalent) and output escaping (using esc_attr, esc_js, or equivalent functions) for all plugin settings. Administrators should navigate to WordPress Admin > Plugins, locate WP Lightbox 2, and apply the available update. Until patching is possible, restrict administrative access to the plugin settings to trusted users only, disable the plugin if not actively used, and monitor for suspicious JavaScript injections in site content via security audit logs. For multisite administrators, enforce stricter role-based capability restrictions and review recent changes to plugin settings for evidence of XSS payload injection. The WPScan vulnerability record at https://wpscan.com/vulnerability/e0536061-140d-47eb-9e8b-9785b52c62f7/ provides additional context and may include updated patch availability information.