— Unscored

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the…

CVE-2026-118438

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.

Assessment

CVSS: Not yet scored
Severity: Unscored
Known exploited: Not listed in CISA KEV
Exploit availability: Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
Published: 31 October 2026
Last updated: 31 October 2026
Affected: Unknown
Assigner: WPScan

At the source

EUVD (ENISA)

References

https://wpscan.com/vulnerability/ddf2cb3f-3aa6-4994-8682-cdb2f4fc086e/

Query this programmatically

Agents can read this through the MCP endpoint, or over HTTP:

curl https://cve.zerocrew.in/api/cve/CVE-2026-118438