CVE-2026-118165
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 30, 2026
Vendor
unknown
Description
The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.