EUVD-2026-26005Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input sanitization and output escaping in the bundled Lity.js lightbox library, where user-controlled input from the href attribute is concatenated directly into a jQuery HTML string without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting (XSS) in the Woostify WordPress plugin through version 2.5.0 allows authenticated attackers with Contributor-level access and above to inject arbitrary JavaScript into pages via unsanitized href attributes in the bundled Lity.js lightbox library. The injected scripts execute in the browsers of any user visiting the compromised page, enabling account takeover, credential theft, and malware distribution. No public exploit code has been identified at the time of analysis, but the vulnerability requires only low complexity network access with authenticated credentials.
Technical ContextAI
The vulnerability exists in the Lity.js lightbox library bundled with Woostify, specifically in how it processes href attributes without proper input sanitization or output escaping before inserting them into jQuery HTML strings. The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic DOM-based XSS flaw. The Lity.js library constructs dynamic HTML elements by concatenating user-controlled href values directly into jQuery selectors and HTML fragments without sanitizing malicious script tags or event handlers. WordPress sites running Woostify versions up to 2.5.0 (CPE: cpe:2.3:a:duongancol:woostify:*:*:*:*:*:*:*:*) are affected. The vulnerability is triggered when authenticated users with Contributor role or higher craft specially-formatted href attributes (containing script payloads) that are then rendered in lightbox elements, bypassing browser same-origin policies through stored persistence.
RemediationAI
Update Woostify immediately to version 2.5.1 or later, which includes fixes to the Lity.js library. WordPress administrators can update via the WordPress admin dashboard (Appearance > Themes > Updates) or via the WordPress.org theme directory. The upstream fix has been confirmed via GitHub commit a4669598aa8c5de344dda6c3d42389a3c2e61adc, which implements proper input sanitization and output escaping for href attributes in the Lity.js lightbox library. As a temporary workaround on sites unable to immediately patch, restrict Contributor-level role assignments to trusted users only, or disable the Woostify lightbox feature if not essential by dequeuing the Lity.js script via a custom WordPress filter (e.g., wp_dequeue_script('lity-js')). However, role restriction is preferable as it maintains functionality while reducing attack surface. Sites with user-generated content or guest posting capabilities should prioritize patching, as these deployments increase likelihood of Contributor access being granted to less-trusted accounts.
The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t
The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to unauthorized modification of data
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today