The vulnerability arises from improper neutralization of user input during web page generation. It allows an attacker to inject malicious script that is stored by the LightBox Block plugin and subsequently executed in visitors’ browsers. This stored XSS can be used to deface the site, steal session cookies, or install malware on end‑users. The weakness corresponds to CWE‑79, a classic example of input validation failure.

This flaw affects the bPlugins LightBox Block plugin for WordPress, impacting all installations that use any version from the initial release up through version 1.2.0. Users of earlier or later releases are not affected. The plugin is used to embed image galleries and lightbox functionality within posts and pages.

The CVSS v3 score of 6.5 indicates a moderate‑impact vulnerability. EPSS is not available, so the current exploit probability is unknown, and the issue is not listed in the CISA KEV catalog. The likely attack vector is a stored XSS, where a malicious administrator or trusted user can insert script into the block’s content field. Once injected, the code would run in the browser of any visitor viewing the affected content, potentially compromising user credentials and the integrity of the site.