EUVD-2026-51412
GHSA-r6rj-q66h-w8m7
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
PR:H reflects required author role; UI:R reflects mandatory lightbox interaction; C:H and I:H cover session hijack and account takeover; A:N as XSS carries no direct availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above (who lack the unfiltered_html capability) to store JavaScript that runs when a visitor or administrator opens the lightbox.
AnalysisAI
Stored XSS in the Lightbox with PhotoSwipe WordPress plugin before 5.9.0 allows author-level users (lacking unfiltered_html) to inject arbitrary JavaScript into image lightbox captions via an unsanitized link data attribute. The payload executes in the browser of any visitor or administrator who opens the affected lightbox, enabling session hijacking or privilege escalation against site administrators. A publicly available exploit documents the technique; no active exploitation is confirmed via CISA KEV, though the author-level entry bar is low on sites with multiple contributors.
Technical ContextAI
The plugin integrates the PhotoSwipe JavaScript lightbox library into WordPress to display images in an overlay viewer. It fails to sanitize or HTML-encode a link's data attribute before injecting it into the lightbox caption rendered in the DOM, a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) defect. WordPress's permission model normally prevents author-level users from saving raw HTML/JavaScript via the unfiltered_html capability, but this bypass occurs at the plugin rendering layer, outside WordPress's standard sanitization pipeline. The CPE string (cpe:2.3:a:unknown:lightbox_with_photoswipe:*:*:*:*:*:*:*:*) covers all versions of the plugin prior to 5.9.0.
RemediationAI
Update the Lightbox with PhotoSwipe plugin to version 5.9.0 or later, which introduces proper sanitization and escaping of the link data attribute before it is rendered into the lightbox caption. The fix is confirmed available from the vendor per the WPScan advisory (https://wpscan.com/vulnerability/aae59cb8-b259-464e-a86b-164d89f61342/). If immediate patching is not possible, a targeted compensating control is to restrict the WordPress author role so that no untrusted user holds it - this eliminates the attacker's required entry point. Alternatively, temporarily deactivating the plugin removes the vulnerable rendering path entirely, trading lightbox functionality for security. Do not rely on input filtering at the post-editor level alone, as the vulnerability bypasses WordPress's standard unfiltered_html gate at the plugin rendering layer.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today