CVE-2026-118165

MediumCVSS 6.8/10Last modified Oct 30, 2026

Description

The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownFirelight Lightbox< 2.3.23

References

Timeline

Published
Oct 30, 2026
Last modified
Oct 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1181664.8The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from bCVE-2026-1181675.3The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration CVE-2026-1181685.3The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenCVE-2026-1181694.9The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conCVE-2026-118175.3This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In CVE-2026-1181709.1The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying wheCVE-2026-1181716.5The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-priviCVE-2026-1181726.1The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatCVE-2026-1181736.1MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. CVE-2026-1181746.5When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importCVE-2026-1181757.5When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the CVE-2026-1181768.1Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-lengt
CVE-2026-118165: Medium severity, CVSS 6.8 | Vulnix