PT-2026-26852 · Arevico · Multi Functional Flexi Lightbox

San6051 · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-3347

NVD

CVSS v3.1

5.5

Medium

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

The Multi Functional Flexi Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the arv lb[message] parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This is due to the arv lb options val() sanitize callback returning user input without any sanitization, and the stored message value being output in the genLB() function without escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page or post with the lightbox enabled.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3347

Affected Products

Multi Functional Flexi Lightbox

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-3347 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a4c0b14a-d039-4008-a433-ab3605e2612c?source=cve · Note
• https://plugins.trac.wordpress.org/browser/multi-functional-flexi-lightbox/trunk/sp.php#L37 · Note
• https://plugins.trac.wordpress.org/browser/multi-functional-flexi-lightbox/tags/1.2/options.php#L94 · Note
• https://plugins.trac.wordpress.org/browser/multi-functional-flexi-lightbox/trunk/options.php#L94 · Note
• https://plugins.trac.wordpress.org/browser/multi-functional-flexi-lightbox/tags/1.2/sp.php#L37 · Note