CVE-2026-124649: Lightbox with PhotoSwipe < 5.19.0 - Unauthenticated Stored XSS via Comment Link Title
The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link titles and other caption sources before inserting them as HTML into the image lightbox caption, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks via comments.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated users can exploit it by submitting a comment containing a malicious link title or other caption source that the plugin inserts into an image lightbox caption as HTML.
Are sites affected if comments are enabled?
Sites using a version of Lightbox with PhotoSwipe earlier than 5.19.0 may be affected where attacker-controlled comment content can supply link titles or other caption data displayed by the lightbox.
What should be done to remediate the issue?
Update Lightbox with PhotoSwipe to version 5.19.0 or later. If updating cannot be performed immediately, restrict or disable untrusted comment submissions to reduce the opportunity for unauthenticated attackers to store malicious caption content.
How can administrators check for possible exploitation?
Review comments and associated link titles or caption sources for unexpected HTML or script-like content, especially content that is later displayed in image lightbox captions.