CVE-2026-124649 in Lightbox with PhotoSwipe Plugin
Summary
by MITRE • 11/14/2026
The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link titles and other caption sources before inserting them as HTML into the image lightbox caption, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks via comments.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/14/2026
The vulnerability identified in Lightbox with PhotoSwipe versions prior to 5.19.0 represents a critical security flaw rooted in insufficient input validation and output encoding mechanisms within the WordPress plugin architecture. Specifically, the application fails to properly sanitize link titles and various caption sources before they are rendered as HTML content within the image lightbox interface. This oversight creates an environment where malicious actors can inject executable script payloads into fields that are subsequently displayed to other users without adequate filtering or escaping of special characters. The core technical failure lies in the direct insertion of user-supplied data into the DOM structure of the lightbox caption area, bypassing standard security controls such as HTML entity encoding or strict allow-list validation for permitted tags and attributes.
From an operational perspective, this flaw enables unauthenticated attackers to execute Stored Cross-Site Scripting attacks against any visitor who views content containing the compromised captions. Unlike reflected XSS which requires tricking a user into clicking a malicious link, stored vulnerabilities persist on the server side or in the database, meaning every subsequent view of the affected media triggers the execution of the injected script. This persistence significantly amplifies the potential impact, as it does not rely on social engineering to deliver the payload but rather exploits the inherent trust users place in legitimate website content. The attack vector typically involves submitting a comment or modifying caption metadata through available public-facing endpoints that do not enforce strict sanitization protocols before database storage and subsequent retrieval for display.
The consequences of this vulnerability extend beyond simple script execution, potentially leading to session hijacking, credential theft via keyloggers embedded in the injected scripts, defacement of the website appearance, or redirection of users to phishing sites designed to harvest sensitive information. In environments where user accounts have elevated privileges, such as administrators viewing comments on their dashboard, the impact could escalate to full site compromise if the stored script exploits additional vulnerabilities within the admin interface. This aligns with common weakness enumeration standards that highlight improper neutralization of special elements used in an output context, specifically categorized under CWE-79: Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting.
To mitigate this risk, immediate action is required to upgrade the Lightbox with PhotoSwipe plugin to version 5.19.0 or later, where these sanitization issues have been addressed by developers through enhanced input filtering and output encoding practices. For organizations unable to patch immediately due to compatibility constraints, implementing a Web Application Firewall rule that detects and blocks common XSS payload patterns in comment fields and caption inputs can provide temporary protection. Additionally, enforcing Content Security Policy headers with strict directives regarding script execution sources can help mitigate the impact of any successfully injected scripts by preventing them from executing unless they originate from trusted domains. Regular security audits focusing on user input handling across all public-facing forms are essential to prevent similar vulnerabilities in other plugins or custom code within the WordPress ecosystem.