The LightPress Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attribute in the shortcode in all versions up to, and including, 2.3.4.

Code

The project this record applies to. Exploit listings stay in References.

• Plugin source · wordpress.org

Timeline

Detection, updates, and resolution for this record.

1. Apr 8, 2026 · NIST NVD

   Detected

   The LightPress Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attribute in the shortcode in all versions up to, and including, 2.3.4. This is due to the plugin modifying gallery shortcode output to include the attribute value without proper escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary

2. Jul 25, 2026 · NIST NVD

   Updated

   The LightPress Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attribute in the shortcode in all versions up to, and including, 2.3.4. This is due to the plugin modifying gallery shortcode output to include the attribute value without proper escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary

Sources

• CVE.orgVulnerability recordCVE-2026-4379

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-4379

  The LightPress Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attribute in the shortcode in all versions up to, and including, 2.3.4. This is due to the plugin modifying gallery shortcode output to include the attrib

  nvd.nist.gov

References

• Reference · plugins.trac.wordpress.org
• Reference · plugins.trac.wordpress.org
• Reference · plugins.trac.wordpress.org
• Reference · wordfence.com