The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Sto…
CVSS 3.1MEDIUM 5.9·Network·High privileges·User interaction·EPSS 0.00313·Published 2025-05-16·Fixed in 2.9.4CWE-79