Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: Lightpress Clear all filters
TI-2025-03216 CVE-2025-3649 · GHSA-f7g9-mhw7-w4wj

LightPress Lightbox < 2.3.4 - Contributor+ Stored XSS

Priority HIGH 65

The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00455 Published 2025-05-12 Fixed in 2.3.4 CWE-79
TI-2024-05041 CVE-2024-5425 · GHSA-3xmq-r8x8-g9h7

WP jQuery Lightbox <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Attribute

Priority LOW 28

The WP jQuery Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ attribute in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0034 Published 2024-06-07 No fix listed CWE-79