Read the docs

Lightpress

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Lightpress records in CISA KEV

No Lightpress vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Lightbox 2 records HIGH

Records

2 records in Lightbox · all components

TI-2025-03216 CVE-2025-3649 · GHSA-f7g9-mhw7-w4wj

LightPress Lightbox < 2.3.4 - Contributor+ Stored XSS

Priority HIGH 65

The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00455 Published 2025-05-12 Fixed in 2.3.4 CWE-79
TI-2024-05041 CVE-2024-5425 · GHSA-3xmq-r8x8-g9h7

WP jQuery Lightbox <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Attribute

Priority LOW 28

The WP jQuery Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ attribute in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0034 Published 2024-06-07 No fix listed CWE-79
Open these records in search →