Image Gallery, Lightbox Galleries, Modal Windows <= 2.38.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Captions
- ID
- WPSEC-2026-3000
- Plugin
- MetaSlider Gallery – Image Gallery, Lightbox Galleries, Modal Windows (ml-slider-lightbox)
- Affected
- all versions before 2.39.0
- Remediation
- Update to 2.39.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Image Gallery, Lightbox Galleries, Modal Windows on WPSec AttackSurface
- Fix released
- Published
Description
The Image Gallery, Lightbox Galleries, Modal Windows plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via lightbox captions (the data-sub-html caption attribute) in all versions up to, and including, 2.38.0, due to the client-side caption sanitiser parsing untrusted caption HTML inside the live document before applying its tag allowlist. Entity-encoded markup survives WordPress's content filtering and is decoded by the browser into HTML, so event handlers such as onerror run while the caption is being sanitised. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page where the lightbox is initialised on the injected content.
References
- https://wpsec.com/vuln/WPSEC-2026-3000/
- https://plugins.svn.wordpress.org/ml-slider-lightbox/tags/2.39.0/
- https://wordpress.org/plugins/ml-slider-lightbox/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS