LightBox Block EUVD-2026-109995

Exploitation requires an authenticated WordPress account with privileges to add or edit content using the bPlugins LightBox Block (PR:L - a low-privilege role such as contributor or author, per the CVSS vector; the exact role is not specified in the available sources). It also requires victim interaction (UI:R): another user, typically an administrator, must load the page containing the stored payload for the script to execute. The affected plugin must be installed and active on versions up to and including 1.2.0. These factors - needing a valid account to inject and a separate victim to render the content - meaningfully limit exploitation compared to an unauthenticated flaw; the precise vulnerable field is not described in the available sources.

This is a moderate, not emergency, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) describes a network-reachable but authenticated flaw: PR:L means an attacker needs at least low-privilege access (a WordPress account able to author/edit block content, e.g. contributor or author), and UI:R means a victim - typically an administrator or another user - must view the page carrying the stored payload before the script fires. The scope change (S:C) reflects that injected JavaScript executes in the victim's browser session rather than the vulnerable component, which is why all three impact metrics are Low. No EPSS score was supplied, the CVE is not listed in CISA KEV, and the only reference is the Patchstack database entry rather than working exploit code, so there is no evidence of active exploitation or a published weaponized exploit. The vuln.today decision label is 'this_month,' consistent with a real-but-not-urgent stored XSS. The main caveat: the exact injection point and whether the privilege really is contributor-level versus admin-only is not described in the available sources, so the PR:L assumption should be verified against the Patchstack advisory.

A low-privileged authenticated user (such as a contributor or author) inserts a LightBox Block containing a malicious script payload into a post or page. When an administrator or other user later views that content in the browser, the stored JavaScript executes in their session, enabling actions such as session/cookie theft or admin-context requests. No verified public exploit code was identified; the sole reference is the Patchstack database entry.