PT-2026-26852 · WordPress · Multi Functional Flexi Lightbox

San6051 · Publicado 2026-03-21 · Atualizado 2026-03-21 · CVE-2026-3347

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Multi Functional Flexi Lightbox plugin for WordPress versions prior to 1.3

Description The software is susceptible to Stored Cross-Site Scripting through the arv lb[message] parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Administrator-level access to inject arbitrary web scripts into pages. These scripts execute when a user accesses a page or post with the lightbox enabled. The arv lb options val() sanitize callback returns user input without sanitization, and the stored message value is output in the genLB() function without escaping.

Recommendations Update the Multi Functional Flexi Lightbox plugin to version 1.3 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-3347

Produtos afetados

Multi Functional Flexi Lightbox

Referências · 7

• https://plugins.trac.wordpress.org/browser/multi-functional-flexi-lightbox/trunk/sp.php#L37 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/a4c0b14a-d039-4008-a433-ab3605e2612c?source=cve · Nota
• https://twitter.com/CVEnew/status/2035237258849386823 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/multi-functional-flexi-lightbox/tags/1.2/options.php#L94 · Nota
• https://plugins.trac.wordpress.org/browser/multi-functional-flexi-lightbox/tags/1.2/sp.php#L37 · Nota
• https://plugins.trac.wordpress.org/browser/multi-functional-flexi-lightbox/trunk/options.php#L94 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3347 · Nota de Segurança