The vulnerability is a stored cross‑site scripting flaw that allows an attacker to insert arbitrary JavaScript into pages that the WordPress site serves. It arises because the plugin does not properly neutralize input before rendering it on the web page. If successfully exploited, the injected script will persist for all users who view the affected page, providing the attacker with a persistent attack surface.

The issue affects any installation of the bPlugins LightBox Block plugin for WordPress with a version number from the earliest releases through 1.1.30. No other version information is specified, so any deployment of the plugin at or below 1.1.30 is considered vulnerable.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1 % suggests that exploitation has been relatively rare. The flaw is not listed in CISA’s KEV catalog. Based on the description, the most likely attack vector is an authenticated user who can post or edit content through the plugin’s administrative interface; the malicious payload is then stored and rendered to all visitors of the site.