CVE-2026-116395: WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Q: What access and conditions are required for exploitation?

The CVSS vector indicates network access, low privileges, and user interaction are required. The available data does not identify the specific low-privilege role or the interaction needed.

Q: What is the likely security impact if exploitation succeeds?

The CVSS vector rates confidentiality, integrity, and availability impact as low, with scope changed. This indicates the issue may affect resources beyond the initially vulnerable component.

Published Oct 26, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through 1.2.0.

Affected Software

1 affected component

bPlugins LightBox Block<=1.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress LightBox Block plugin to a version that resolves this vulnerability.
Fixed in 1.2.1

Event History

Oct 26, 2026

CVE Published

via MITRE·04:46 PM

Data Sourced

via MITRE·04:46 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What access and conditions are required for exploitation?

The CVSS vector indicates network access, low privileges, and user interaction are required. The available data does not identify the specific low-privilege role or the interaction needed.

What is the likely security impact if exploitation succeeds?