# Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.8.7 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Image Attributes

- **ID:** WPSEC-2026-2742
- **Plugin:** Lightbox & Modal Popup WordPress Plugin – FooBox (`foobox-image-lightbox`), https://wordpress.org/plugins/foobox-image-lightbox/
- **Affected versions:** all versions before 2.8.8
- **Fixed in:** 2.8.8 (Update to 2.8.8 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/foobox-image-lightbox
- **Fix released:** 2026-11-07
- **Published:** 2026-11-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2742/

## Description

The FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via image attributes and WordPress captions in all versions up to, and including, 2.8.7. This is due to insufficient sanitization of caption text before the lightbox script compares it with image attributes and renders it. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages. The scripts run in the browser of any user who opens the affected image in the FooBox lightbox.

## References

- https://wpsec.com/vuln/WPSEC-2026-2742/
- https://plugins.svn.wordpress.org/foobox-image-lightbox/tags/2.8.8/
- https://wordpress.org/plugins/foobox-image-lightbox/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2742/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.