The Ari Fancy Lightbox plugin for WordPress does not properly neutralize user‑supplied input when generating web pages, allowing attackers to store malicious scripts that will execute in the browser of any user who views a page rendered by the plugin. This stored cross‑site scripting (XSS) flaw can lead to session hijacking, defacement, or the delivery of additional malware, compromising confidentiality, integrity and availability of the affected site.

The vulnerability affects the arisoft ARI Fancy Lightbox plugin, version 1.4.0 and earlier. WordPress sites that have installed and enabled this plugin before the release of a fixed version are susceptible.

The CVSS score of 6.5 indicates a moderately high severity, while the EPSS score of less than 1 % suggests a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is an authenticated or unauthenticated user capable of inserting malicious data into the plugin’s storage fields, which is then rendered in a web page viewed by other users.