# Image Gallery, Lightbox Galleries, Modal Windows <= 2.38.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Captions

- **ID:** WPSEC-2026-3000
- **Plugin:** MetaSlider Gallery – Image Gallery, Lightbox Galleries, Modal Windows (`ml-slider-lightbox`), https://wordpress.org/plugins/ml-slider-lightbox/
- **Affected versions:** all versions before 2.39.0
- **Fixed in:** 2.39.0 (Update to 2.39.0 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ml-slider-lightbox
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3000/

## Description

The Image Gallery, Lightbox Galleries, Modal Windows plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via lightbox captions (the data-sub-html caption attribute) in all versions up to, and including, 2.38.0, due to the client-side caption sanitiser parsing untrusted caption HTML inside the live document before applying its tag allowlist. Entity-encoded markup survives WordPress's content filtering and is decoded by the browser into HTML, so event handlers such as onerror run while the caption is being sanitised. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page where the lightbox is initialised on the injected content.

## References

- https://wpsec.com/vuln/WPSEC-2026-3000/
- https://plugins.svn.wordpress.org/ml-slider-lightbox/tags/2.39.0/
- https://wordpress.org/plugins/ml-slider-lightbox/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3000/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.