Skip to content
Sign in
4.8 Medium

CVE-2026-1430 The WP Lightbox 2 WordPress plugin before 3.0.7 does not sanitise and escape some of its settings, which could allow…

Description

The WP Lightbox 2 WordPress plugin before 3.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected products and versions

Product Affected versions Fixed in
WP Lightbox 2 3.0 earliest → < 3.0.7 3.0.7

Other CVEs of WP Lightbox 2

The 2 CVEs of WP Lightbox 2 →
CVE-2025-3745 The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of… 6.3 Medium
Track this CVE