Firelight Lightbox EUVD-2026-113732

Exploitation requires an authenticated account with at least Contributor role on the target WordPress site and use of the plugin's Classic lightbox mode, where a link URL is stored without output escaping. The payload is not self-executing: it requires a separate victim to click the crafted link (UI:R), so impact depends on a higher-privileged user interacting with the malicious content. Limiting factors: authenticated low-privilege access is needed (not remote-unauthenticated), the Classic lightbox feature must be in use, victim interaction (clicking the link) is mandatory, and the affected plugin version must be below 2.3.23. Updating to 2.3.23 is the vendor-provided fix.

The signals point to a genuine but non-urgent, moderate-priority issue rather than a top-tier emergency. The supplied CVSS 3.1 vector (6.8, AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) rates impact as total across confidentiality, integrity and availability, but EPSS is only 0.15% (4th percentile), there is no CISA KEV listing, and the SSVC decision framework records Exploitation: none and Automatable: no - consistent with the vuln.today 'this_month' priority rather than act_now/emergency. The strongest counterweight is that exploitation is not automatable and requires both an authenticated foothold and victim interaction, which keeps real-world probability low despite the 'Technical Impact: total' rating. Two signals should be flagged as conflicting: (1) the input CVSS vector encodes PR:H (high privileges), yet the description states the flaw is reachable by a 'role as low as Contributor', which is a low-privilege role - this suggests PR:L is the more accurate privilege metric and the vector may overstate the required privilege; (2) the C:H/I:H/A:H impact is high for a stored XSS whose payload executes in a victim's browser - realistic impact depends on whether an administrator is the one who clicks. No KEV and low EPSS together indicate this is not currently being exploited at scale.

An attacker who already holds a Contributor-level account on the target WordPress site creates or edits content using the Firelight Classic lightbox and sets a link URL containing a crafted JavaScript payload, which is stored unescaped and rendered as HTML. When a higher-privileged user (e.g. an editor or administrator) later clicks the crafted link, the script executes in their authenticated browser session. No public exploit identified at time of analysis; the trigger mechanism is described (unescaped lightbox link URL) but no working proof-of-concept code is provided in the sources.