EUVD-2026-26005Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input sanitization and output escaping in the bundled Lity.js lightbox library, where user-controlled input from the href attribute is concatenated directly into a jQuery HTML string without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting (XSS) in the Woostify WordPress plugin through version 2.5.0 allows authenticated attackers with Contributor-level access and above to inject arbitrary JavaScript into pages via unsanitized href attributes in the bundled Lity.js lightbox library. The injected scripts execute in the browsers of any user visiting the compromised page, enabling account takeover, credential theft, and malware distribution. No public exploit code has been identified at the time of analysis, but the vulnerability requires only low complexity network access with authenticated credentials.
Technical ContextAI
The vulnerability exists in the Lity.js lightbox library bundled with Woostify, specifically in how it processes href attributes without proper input sanitization or output escaping before inserting them into jQuery HTML strings. The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic DOM-based XSS flaw. The Lity.js library constructs dynamic HTML elements by concatenating user-controlled href values directly into jQuery selectors and HTML fragments without sanitizing malicious script tags or event handlers. WordPress sites running Woostify versions up to 2.5.0 (CPE: cpe:2.3:a:duongancol:woostify:*:*:*:*:*:*:*:*) are affected. The vulnerability is triggered when authenticated users with Contributor role or higher craft specially-formatted href attributes (containing script payloads) that are then rendered in lightbox elements, bypassing browser same-origin policies through stored persistence.
RemediationAI
Update Woostify immediately to version 2.5.1 or later, which includes fixes to the Lity.js library. WordPress administrators can update via the WordPress admin dashboard (Appearance > Themes > Updates) or via the WordPress.org theme directory. The upstream fix has been confirmed via GitHub commit a4669598aa8c5de344dda6c3d42389a3c2e61adc, which implements proper input sanitization and output escaping for href attributes in the Lity.js lightbox library. As a temporary workaround on sites unable to immediately patch, restrict Contributor-level role assignments to trusted users only, or disable the Woostify lightbox feature if not essential by dequeuing the Lity.js script via a custom WordPress filter (e.g., wp_dequeue_script('lity-js')). However, role restriction is preferable as it maintains functionality while reducing attack surface. Sites with user-generated content or guest posting capabilities should prioritize patching, as these deployments increase likelihood of Contributor access being granted to less-trusted accounts.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today