{
 "id": "WPSEC-2026-2742",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2742/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2742/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2742/index.md",
 "title": "Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.8.7 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Image Attributes",
 "description": "The FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via image attributes and WordPress captions in all versions up to, and including, 2.8.7. This is due to insufficient sanitization of caption text before the lightbox script compares it with image attributes and renders it. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages. The scripts run in the browser of any user who opens the affected image in the FooBox lightbox.",
 "plugin": {
  "slug": "foobox-image-lightbox",
  "name": "Lightbox & Modal Popup WordPress Plugin – FooBox",
  "full_name": "Lightbox & Modal Popup WordPress Plugin – FooBox",
  "wordpress_org": "https://wordpress.org/plugins/foobox-image-lightbox/",
  "advisories_url": "https://wpsec.com/vuln/plugin/foobox-image-lightbox/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/foobox-image-lightbox"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.8",
 "remediation": "Update to 2.8.8 or later.",
 "fix_released": "2026-11-07T16:15:48+00:00",
 "published": "2026-11-08T16:41:10+00:00",
 "updated": "2026-11-08T13:07:55.369573+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2742/",
  "https://plugins.svn.wordpress.org/foobox-image-lightbox/tags/2.8.8/",
  "https://wordpress.org/plugins/foobox-image-lightbox/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/foobox-image-lightbox",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-08"
 }
}