Executive brief
A vulnerability in the Lightbox with PhotoSwipe WordPress plugin allows users with Author-level access to inject malicious scripts into image captions. When a site visitor or administrator views the affected image in a lightbox, the script executes in their browser. This could lead to unauthorized actions being performed on behalf of the victim, including the potential theft of administrative session cookies.
Technical details
The Lightbox with PhotoSwipe plugin fails to properly sanitize or escape the 'data-lbwps-caption' attribute before rendering it within the image lightbox caption. An attacker with Author-level privileges (or a Contributor whose post is reviewed) can craft a malicious link containing HTML-encoded JavaScript. Because the plugin decodes this attribute when building the lightbox UI, the script executes when a user clicks the link to view the image. This is a stored XSS vulnerability (CWE-79) that bypasses standard WordPress 'unfiltered_html' protections. The issue is resolved in version 5.9.0.
Affected products
- Unknown Lightbox with PhotoSwipe < 5.9.0
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-31: advisory: NVD publication date
- 2026-07-13: patched: Fixed in version 5.9.0