https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-02T03:55:33.655284+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-118165 fkie_cve-2026-118165 2026-11-02T03:55:33.674171+00:00

The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.

 https://db.gcve.eu/vuln/ghsa-335m-jcx3-h636 GHSA-335m-jcx3-h636 2026-11-02T03:55:33.674254+00:00

The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.