The Lightbox & Modal Popup WordPress Plugin – FooBox contains insufficient input sanitization and output escaping in image alternative texts, enabling stored Cross‑Site Scripting. An attacker with Author or higher privileges can inject JavaScript that will execute for any visitor of the infected page, potentially enabling malicious actions in the browsers of those visitors.

Every WordPress installation that has fooplugins’ Lightbox & Modal Popup WordPress Plugin – FooBox installed, versions 2.7.34 and older. The flaw is present in all releases up to and including 2.7.34 and affects any site that uses the plugin in its default configuration.

The CVSS score of 6.4 indicates a moderate severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Though only reachable by users with Author‑level authentication, the payload can be posted to any publicly accessible image alt field, making site‑wide script injection feasible for the compromised account. The attack vector is inferred to be local access via authenticated accounts, which then propagates to visitors of manipulated pages.