CVE-2026-124649

UNKNOWN 0.0

Lightbox with PhotoSwipe < 5.19.0 - Unauthenticated Stored XSS via Comment Link Title

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link titles and other caption sources before inserting them as HTML into the image lightbox caption, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks via comments.

Vendor	unknown
Product	lightbox with photoswipe
Published	Nov 14, 2026

Stay Ahead of the Next One

Get instant alerts for unknown lightbox with photoswipe

Be the first to know when new unknown vulnerabilities affecting unknown lightbox with photoswipe are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Lightbox with PhotoSwipe

0 < 5.19.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/c2c4ba65-7e51-4ec1-b7a9-8248071c86de/

Credits

Nguyen Huy Tien WPScan