CVE-2026-118165: Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute
Published Oct 30, 2026
·Updated
The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.
Event History
Oct 30, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:16 AM
Description
Data Sourced
via NVD·06:16 AM
SeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue, and who is at risk from the payload?
A WordPress user with at least the Contributor role can create a crafted lightbox link. The stored script affects users who click that crafted link.
2
What condition is required for exploitation?
The attacker must be able to supply a link opened by the plugin's Classic lightbox and craft its href value. Exploitation also requires a target user to click the crafted link.
3
Which versions should be remediated?
Firelight Lightbox versions earlier than 2.3.23 are affected. Update to 2.3.23 or later.