CVE-2026-118438— Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute
Quick assessment
Affected
Unknown Firelight Lightbox
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 2.3.24 版本之前的 Firelight Lightbox WordPress 插件中，图片属性值在浏览器处理前未得到正确转义。这可能导致拥有“贡献者”及以上权限的用户注入任意 Web 脚本，当其他用户查看或预览受影响的内容时，这些脚本将被执行。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-118438
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute
Source: CVE Program / CVE List V5
Vulnerability Description
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Firelight Lightbox | 0 ~ 2.3.24 | - |
|
II. Public POCs for CVE-2026-118438
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-118438
请登录查看更多情报信息。
Other References for CVE-2026-118438 (1)
-
https://wpscan.com/vulnerability/ddf2cb3f-3aa6-4994-8682-cdb2f4fc086e/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-10-31 · 11 CVEs total
| CVE-2026-94361 | PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback | |
| CVE-2026-118185 | Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting | |
| CVE-2026-118629 | All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure | |
| CVE-2026-118638 | Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker RE | |
| CVE-2026-118437 | BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion | |
| CVE-2026-82214 | Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure vi | |
| CVE-2026-118184 | Premium Packages < 7.2.2 - Unauthenticated Order Total Manipulation | |
| CVE-2026-118043 | Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal | |
| CVE-2026-110808 | Essential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register_u | |
| CVE-2026-110042 | Payment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Set |
IV. Related Vulnerabilities
Same product: Firelight Lightbox
-
CVE-2026-118165
Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Li -
CVE-2026-6454
Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) -
CVE-2025-5035
Firelight Lightbox < 2.3.16 - Contributor+ Stored XSS -
CVE-2025-52707
WordPress Firelight Lightbox plugin <= 2.3.16 - Cross Site S -
CVE-2025-3597
Firelight Lightbox < 2.3.15 - Contributor+ Stored XSS
Same vendor: Unknown
-
CVE-2026-94361
PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery -
CVE-2026-118185
Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Lim -
CVE-2026-118629
All-in-One Video Gallery < 5.0.0 - Unauthenticated Private a -
CVE-2026-118638
Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Mod -
CVE-2026-118437
BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment