EUVD-2026-14175
GHSA-687q-32c6-8x68
GHSA-gv9p-wq55-477w
GHSA-p747-qc5p-773r
GHSA-wc83-79hj-hpmq
GHSA-xggw-g9pm-9qhh
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Multi Functional Flexi Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the arv_lb[message] parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This is due to the arv_lb_options_val() sanitize callback returning user input without any sanitization, and the stored message value being output in the genLB() function without escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page or post with the lightbox enabled.
AnalysisAI
A Stored Cross-Site Scripting vulnerability exists in the Multi Functional Flexi Lightbox WordPress plugin (versions up to and including 1.2) that allows authenticated administrators to inject arbitrary JavaScript code via the arv_lb[message] parameter. The vulnerability stems from insufficient input sanitization in the arv_lb_options_val() callback function and missing output escaping in the genLB() function, enabling malicious scripts to execute in the browsers of any user viewing pages or posts with the lightbox enabled. With a CVSS score of 5.5 and requiring high-privilege administrator access, this represents a moderate but real risk primarily applicable to compromised or malicious admin accounts.
Technical ContextAI
The vulnerability is a Stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) affecting the Multi Functional Flexi Lightbox plugin for WordPress (identified via CPE cpe:2.3:a:arevico:multi_functional_flexi_lightbox:*:*:*:*:*:*:*:*). The root cause involves two distinct coding failures: the arv_lb_options_val() sanitization callback in options.php (line 94) accepts user input without any sanitization, and the genLB() function in sp.php (line 37) outputs the stored message parameter without HTML escaping. WordPress plugin architecture relies on the options API and sanitization/escaping hooks to prevent such vulnerabilities, and the plugin's failure to properly implement these security mechanisms creates a direct pathway for script injection that persists in the WordPress database and executes in the context of all page visitors.
RemediationAI
Site administrators should immediately deactivate and remove the Multi Functional Flexi Lightbox plugin until a patched version is released, or upgrade to a version beyond 1.2 once available from the plugin author. Until a vendor fix is released, restrict administrator account access to trusted users only and implement strong authentication measures (multi-factor authentication) for all WordPress administrator accounts to prevent unauthorized modifications to plugin settings. Monitor WordPress database tables (wp_options) for suspicious stored values in the arv_lb_options serialized data and review page/post content for unexpected JavaScript embedded in lightbox message parameters. Enable WordPress security plugins with XSS detection capabilities to provide additional defense-in-depth monitoring, and consider using a Web Application Firewall (WAF) to detect and block reflected/stored XSS patterns in administrator requests. Refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a4c0b14a-d039-4008-a433-ab3605e2612c?source=cve for updates on patch availability.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today