Vulnerabilities / Lightbox & Modal Popup WordPress Plugin – FooBox / WPSEC-2026-2742
Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.8.7 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Image Attributes
Medium 6.4
CWE-79Fixed in 2.8.8
- ID
- WPSEC-2026-2742
- Plugin
- Lightbox & Modal Popup WordPress Plugin – FooBox (foobox-image-lightbox)
- Affected
- all versions before 2.8.8
- Remediation
- Update to 2.8.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-08
- Attack surface
- Lightbox & Modal Popup WordPress Plugin – FooBox on WPSec AttackSurface
- Fix released
- Published
Description
The FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via image attributes and WordPress captions in all versions up to, and including, 2.8.7. This is due to insufficient sanitization of caption text before the lightbox script compares it with image attributes and renders it. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages. The scripts run in the browser of any user who opens the affected image in the FooBox lightbox.
References
- https://wpsec.com/vuln/WPSEC-2026-2742/
- https://plugins.svn.wordpress.org/foobox-image-lightbox/tags/2.8.8/
- https://wordpress.org/plugins/foobox-image-lightbox/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS