CVE-2026-118438

{"id": "CVE-2026-118438", "cveTags": [], "metrics": {}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "Firelight Lightbox", "versions": [{"status": "affected", "version": "0", "lessThan": "2.3.24", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-31T06:16:33.923", "references": [{"url": "https://wpscan.com/vulnerability/ddf2cb3f-3aa6-4994-8682-cdb2f4fc086e/", "source": "contact@wpscan.com"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content."}], "lastModified": "2026-10-31T06:16:33.923", "sourceIdentifier": "contact@wpscan.com"}