CVE-2026-4805 in Woostify Plugin
Summary
by MITRE • 04/28/2026
The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input sanitization and output escaping in the bundled Lity.js lightbox library, where user-controlled input from the href attribute is concatenated directly into a jQuery HTML string without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/10/2026
The Woostify WordPress plugin presents a critical stored cross-site scripting vulnerability that affects versions up to and including 2.5.0, representing a significant security risk for WordPress installations. This vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's bundled Lity.js lightbox library, which operates at a fundamental level of web application security. The flaw specifically manifests when user-controlled input from the href attribute is directly concatenated into a jQuery HTML string without proper sanitization, creating an exploitable condition that violates core security principles of input validation and output encoding.
The technical implementation of this vulnerability allows authenticated attackers who possess Contributor-level access or higher to execute malicious scripts within the context of affected websites. This privilege escalation path represents a serious concern as it leverages legitimate user permissions to inject persistent malicious code that can affect all users who view pages containing the injected content. The vulnerability operates through a classic stored XSS attack vector where malicious payloads are stored on the server and executed when other users access the compromised pages, making it particularly dangerous for multi-user environments where content creators and administrators interact with the plugin's functionality.
From an operational perspective, this vulnerability creates substantial risk for WordPress website owners and administrators who rely on the Woostify plugin for their site functionality. The attack surface expands significantly since contributors and above can exploit this flaw without requiring administrator privileges, potentially allowing for widespread impact across user bases. The malicious scripts could perform various harmful actions including cookie theft, session hijacking, redirection to malicious sites, or data exfiltration, making this vulnerability particularly attractive to threat actors seeking persistent access to compromised WordPress installations. The vulnerability's impact is amplified by the fact that it affects the plugin's lightbox functionality, which is commonly used throughout WordPress sites for media presentations and user interactions.
Security practitioners should implement immediate mitigation strategies including updating to patched versions of the Woostify plugin, which would address the insufficient sanitization of the Lity.js library. The vulnerability aligns with CWE-79, which specifically addresses cross-site scripting flaws, and represents a clear violation of the principle of least privilege as described in the MITRE ATT&CK framework under the technique of privilege escalation. Organizations should also consider implementing additional defensive measures such as web application firewalls, input validation rules, and monitoring for suspicious user activities within the plugin's functionality. The remediation process should include thorough testing of updated plugin versions to ensure compatibility with existing site configurations while maintaining security posture against this specific stored XSS vulnerability that could compromise entire WordPress installations through the manipulation of the lightbox component's href attribute handling.