{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-118438","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","state":"PUBLISHED","assignerShortName":"WPScan","dateReserved":"2026-10-28T07:55:03.118Z","datePublished":"2026-10-31T06:00:22.892Z","dateUpdated":"2026-10-31T06:00:22.892Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-31T06:00:22.892Z"},"title":"Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute","problemTypes":[{"descriptions":[{"description":"CWE-79 Cross-Site Scripting (XSS)","lang":"en","type":"CWE"}]}],"affected":[{"vendor":"Unknown","product":"Firelight Lightbox","versions":[{"status":"affected","versionType":"semver","version":"0","lessThan":"2.3.24"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content."}],"references":[{"url":"https://wpscan.com/vulnerability/ddf2cb3f-3aa6-4994-8682-cdb2f4fc086e/","tags":["exploit","vdb-entry","technical-description"]}],"credits":[{"lang":"en","value":"Pierre Rudloff","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}}}}