The Lightbox with PhotoSwipe WordPress plugin before version 5.9.0 does not sanitize the data‑lbwps-caption attribute before rendering it into the image lightbox caption, allowing author‑level or higher users without the unfiltered_html capability to store malicious JavaScript. When a visitor or administrator opens a lightbox, the injected script is executed in the browser’s context, enabling arbitrary code execution on the site. The flaw can be used for cookie theft, session hijacking, content injection, or defacement by leveraging the victim’s privileges, according to CWE‑79.

WordPress installations using the Lightbox with PhotoSwipe plugin with a version earlier than 5.9.0 are affected. The vulnerability applies to any site using that plugin, regardless of size, as long as an author‑level user or higher has access to the plugin’s configuration interface.

The CVSS score of 6.8 indicates a medium severity vulnerability, while the EPSS score of 0.00235 (less than 1%) shows a low probability of exploitation. Attackers only need author‑level access to the plugin’s admin interface to inject the payload; once a visitor opens the lightbox, the injected code runs with the site’s front‑end privileges. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet, but the stored XSS nature and moderate severity warrant prompt remediation.