{
 "id": "WPSEC-2026-3000",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3000/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3000/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3000/index.md",
 "title": "Image Gallery, Lightbox Galleries, Modal Windows <= 2.38.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Captions",
 "description": "The Image Gallery, Lightbox Galleries, Modal Windows plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via lightbox captions (the data-sub-html caption attribute) in all versions up to, and including, 2.38.0, due to the client-side caption sanitiser parsing untrusted caption HTML inside the live document before applying its tag allowlist. Entity-encoded markup survives WordPress's content filtering and is decoded by the browser into HTML, so event handlers such as onerror run while the caption is being sanitised. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page where the lightbox is initialised on the injected content.",
 "plugin": {
  "slug": "ml-slider-lightbox",
  "name": "Image Gallery, Lightbox Galleries, Modal Windows",
  "full_name": "MetaSlider Gallery – Image Gallery, Lightbox Galleries, Modal Windows",
  "wordpress_org": "https://wordpress.org/plugins/ml-slider-lightbox/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ml-slider-lightbox/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ml-slider-lightbox"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.39.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.39.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.39.0",
 "remediation": "Update to 2.39.0 or later.",
 "fix_released": "2026-11-11T18:44:00+00:00",
 "published": "2026-11-12T18:51:01+00:00",
 "updated": "2026-11-12T17:09:33.745333+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3000/",
  "https://plugins.svn.wordpress.org/ml-slider-lightbox/tags/2.39.0/",
  "https://wordpress.org/plugins/ml-slider-lightbox/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ml-slider-lightbox",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}