PT-2026-31073 · WordPress · Lightpress Lightbox

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-4379

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LightPress Lightbox plugin for WordPress versions up to and including 2.3.4

Description The LightPress Lightbox plugin for WordPress is susceptible to Stored Cross-Site Scripting through the group attribute within the [gallery] shortcode. The plugin improperly handles the group attribute value, failing to properly escape it when modifying gallery shortcode output. This allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. These scripts will then execute whenever a user accesses the compromised page.

Recommendations Update the LightPress Lightbox plugin to a version later than 2.3.4.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4379

Affected Products

Lightpress Lightbox

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-4379 · Security Note
• https://plugins.trac.wordpress.org/changeset?old_path=/wp-jquery-lightbox/tags/2.3.4&new_path=/wp-jquery-lightbox/tags/2.3.5 · Note
• https://plugins.trac.wordpress.org/browser/wp-jquery-lightbox/tags/2.3.4/lightboxes/wp-jquery-lightbox/class-wp-jquery-lightbox.php#L376 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2bed4818-70c5-40b7-8d8d-f43f3baa0f3d?source=cve · Note
• https://twitter.com/CVEnew/status/2041711815244321043 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-jquery-lightbox/tags/2.3.4/lightboxes/wp-jquery-lightbox/class-wp-jquery-lightbox.php#L395 · Note
• https://twitter.com/CVEarity/status/2041822624062566830 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2041809005421400266 · Twitter Post
• https://t.me/cveNotify/158407 · Telegram Post
• https://t.me/CVEtracker/50010 · Telegram Post