PT-2025-20682 · WordPress · Lightpress Lightbox

Pierre Rudloff · Published 2025-05-12 · Updated 2025-05-12 · CVE-2025-3649

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LightPress Lightbox plugin for WordPress versions prior to 2.3.4

Description The issue allows users with at least the contributor role to conduct Stored XSS attacks due to the plugin not checking if download links point to valid, non-Javascript URLs.

Recommendations For versions prior to 2.3.4, update to version 2.3.4 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-3649

Affected Products

Lightpress Lightbox

References · 8

• 🔥 https://wpscan.com/vulnerability/37fb7f3b-1766-4c2c-9b78-f77f15a04476 · Exploit
• https://osv.dev/vulnerability/CVE-2025-3649 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3649 · Security Note
• https://t.me/cvenotify/121768 · Telegram Post
• https://twitter.com/CVEnew/status/1921813268517069202 · Twitter Post
• https://t.me/cvedetector/25068 · Telegram Post
• https://t.me/cvetracker/23601 · Telegram Post
• https://t.me/cvenotify/121714 · Telegram Post