CVE-2026-14833

MediumCVSS 6.8/10Last modified Aug 26, 2026

Description

The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above (who lack the unfiltered_html capability) to store JavaScript that runs when a visitor or administrator opens the lightbox.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Lightbox with PhotoSwipe	< 5.9.0

References

https://wpscan.com/vulnerability/aae59cb8-b259-464e-a86b-164d89f61342/

Timeline

Published: Jul 31, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-148346.5The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds sub CVE-2026-148356.8The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer scri CVE-2026-148368.1The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code f CVE-2026-148377.8Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged l CVE-2026-148387.4Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Hum CVE-2026-148397.5The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowi CVE-2026-14844.2A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during len CVE-2026-148405.3The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forward CVE-2026-148416.1The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTM CVE-2026-148425.3The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowi CVE-2026-148435.3The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handl CVE-2026-148446.8The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in a