Description
The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | LightPress Lightbox | < 2.3.4 | 2.3.4 |
References
- https://wpscan.com/vulnerability/37fb7f3b-1766-4c2c-9b78-f77f15a04476/ exploit vdb-entry technical-description