Medium‑severity Cross‑Site Scripting exists in the LightPress Lightbox WordPress plugin. By placing specially formatted input in the 'group' attribute of the gallery shortcode, an attacker who can create or edit posts—a Contributor or higher—can embed malicious scripts. Those scripts are stored in the gallery’s markup and run in the browsers of any visitor who views the affected page, allowing execution of arbitrary client‑side code.

All instances of FirelightWP’s LightPress Lightbox up to version 2.3.4 are affected. A user can exploit the vulnerability by adding or editing a gallery shortcode with a crafted 'group' value on any page or post that accepts shortcodes. The vulnerability stops at the plugin level and only affects sites that use this plugin.

The CVSS base score of 6.4 indicates moderate risk. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. However, because the vulnerability requires only contributor‑level access, which is common on many sites, an attacker can easily inject scripts that perform malicious actions such as cookie theft, session hijacking, or defacement once they are embedded in a page viewed by regular users.