What is the CVSS score of CVE-2026-4379?

CVE-2026-4379 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Lightpress Lightbox CVE-2026-4379

EUVD-2026-20034 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-2gmw-2prf-4jf5

WordPress XSS Lightpress Lightbox Wordpress Plugin Firelightwp

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 03:45 euvd

EUVD-2026-20034

Analysis Generated

Apr 08, 2026 - 03:45 vuln.today

CVE Published

Apr 08, 2026 - 02:25 nvd

MEDIUM 6.4

DescriptionCVE.org

The LightPress Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the group attribute in the [gallery] shortcode in all versions up to, and including, 2.3.4. This is due to the plugin modifying gallery shortcode output to include the group attribute value without proper escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

LightPress Lightbox plugin for WordPress allows authenticated attackers with Contributor-level access and above to inject arbitrary JavaScript via the unescaped group attribute in the [gallery] shortcode, resulting in stored cross-site scripting that executes for all users viewing affected pages. The vulnerability affects all versions up to 2.3.4 and has been addressed in version 2.3.5.

Technical ContextAI

The LightPress Lightbox plugin (CPE: cpe:2.3:a:firelightwp:lightpress_lightbox) extends WordPress's native [gallery] shortcode functionality by processing the group attribute to enable lightbox grouping features. The vulnerability stems from a failure to properly escape or sanitize the group attribute value when outputting it into the HTML/JavaScript context. This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a cross-site scripting vulnerability. The affected code in versions through 2.3.4 directly incorporates user-supplied group attribute content into shortcode output without applying WordPress escaping functions such as esc_attr() or esc_js(), allowing malicious script injection through shortcode attributes.

RemediationAI

Update LightPress Lightbox to version 2.3.5 or later immediately. WordPress site administrators should navigate to Plugins → Installed Plugins, locate LightPress Lightbox, and click Update if available. For sites unable to auto-update, manually download version 2.3.5 from the WordPress plugin repository (https://plugins.wordpress.org/lightpress-lightbox/) and upload via Plugins → Add New → Upload Plugin. As a temporary mitigation pending patching, restrict Contributor-level access to users who demonstrably require it, and audit existing gallery shortcodes for suspicious group attribute values that may contain script tags or event handlers. The fix in version 2.3.5 applies proper output escaping to the group attribute; refer to the changeset at plugins.trac.wordpress.org/changeset/?old_path=/wp-jquery-lightbox/tags/2.3.4&new_path=/wp-jquery-lightbox/tags/2.3.5 for technical details.