{"api_version":"1","generated_at":"2026-10-30T10:11:59+00:00","cve":"CVE-2026-118165","urls":{"html":"https://cve.report/CVE-2026-118165","api":"https://cve.report/api/cve/CVE-2026-118165.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-118165","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-118165"},"summary":{"title":"Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute","description":"The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-10-30 06:16:47","updated_at":"2026-10-30 06:16:47"},"problem_types":["CWE-79 Cross-Site Scripting (XSS)"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/345e7a47-ba72-4329-a9d6-9d3a9a8b3321/","name":"https://wpscan.com/vulnerability/345e7a47-ba72-4329-a9d6-9d3a9a8b3321/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-118165","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118165","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"Firelight Lightbox","version":"affected 2.3.23 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Dmitrii Ignatyev","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Firelight Lightbox","vendor":"Unknown","versions":[{"lessThan":"2.3.23","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Dmitrii Ignatyev"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link."}],"problemTypes":[{"descriptions":[{"description":"CWE-79 Cross-Site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-30T06:00:24.399Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/345e7a47-ba72-4329-a9d6-9d3a9a8b3321/"}],"source":{"discovery":"EXTERNAL"},"title":"Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-118165","datePublished":"2026-10-30T06:00:24.399Z","dateReserved":"2026-10-27T17:42:18.948Z","dateUpdated":"2026-10-30T06:00:24.399Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-30 06:16:47","lastModifiedDate":"2026-10-30 06:16:47","problem_types":["CWE-79 Cross-Site Scripting (XSS)"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"118165","Ordinal":"1","Title":"Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightb","CVE":"CVE-2026-118165","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"118165","Ordinal":"1","NoteData":"The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.","Type":"Description","Title":"Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightb"}]}}}