PT-2026-26852 · WordPress · Multi Functional Flexi Lightbox

San6051 · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-3347

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Multi Functional Flexi Lightbox plugin for WordPress versions prior to 1.3

Description The software is susceptible to Stored Cross-Site Scripting through the arv lb[message] parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Administrator-level access to inject arbitrary web scripts into pages. These scripts execute when a user accesses a page or post with the lightbox enabled. The arv lb options val() sanitize callback returns user input without sanitization, and the stored message value is output in the genLB() function without escaping.

Recommendations Update the Multi Functional Flexi Lightbox plugin to version 1.3 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3347

Affected Products

Multi Functional Flexi Lightbox

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-3347 · Security Note
• https://plugins.trac.wordpress.org/browser/multi-functional-flexi-lightbox/trunk/sp.php#L37 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a4c0b14a-d039-4008-a433-ab3605e2612c?source=cve · Note
• https://twitter.com/CVEnew/status/2035237258849386823 · Twitter Post
• https://plugins.trac.wordpress.org/browser/multi-functional-flexi-lightbox/tags/1.2/options.php#L94 · Note
• https://plugins.trac.wordpress.org/browser/multi-functional-flexi-lightbox/tags/1.2/sp.php#L37 · Note
• https://plugins.trac.wordpress.org/browser/multi-functional-flexi-lightbox/trunk/options.php#L94 · Note