Improper neutralization of input during web page generation in the FooBox Image Lightbox plugin allows malicious input to be injected into the output page. This cross‑site scripting flaw can cause browsers to execute attacker‑supplied scripts, leading to client‑side compromise. The weakness is classified as CWE‑79.

All installations of the FooBox Image Lightbox plugin from the earliest releases through version 2.7.33 are vulnerable. The vendor is FooPlugins, and the affected product is FooBox Image Lightbox. Any WordPress site that has versions of the plugin <= 2.7.33 is at risk.

The CVSS score of 5.9 indicates a moderate severity of this cross‑site scripting flaw. With an EPSS score of less than 1%, the likelihood of exploitation at this time is considered low, and the vulnerability is not present in CISA’s KEV catalog. Exploitation would involve supplying crafted input to the plugin that is rendered into a web page, allowing an attacker to inject arbitrary scripts that are executed in the browsers of visitors. Because the flaw relates to content rendering, it is likely that no authentication is required. This combination of moderate impact and low exploitation probability suggests that timely patching is advisable while monitoring for potential exploitation.