CVE-2024-5425
Published
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
2
PROJECTS
Description
The WP jQuery Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ attribute in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
GitHub<p>LightPress Lightbox is a popular, very lightweight lightbox plugin for WordPress. It is active 40,000 websites. After activation, settings will appear under ‘Lightbox’ on your website’s main admin menu, and images and galleries will open in a nice lightbox.</p>
<p>To make images open in the lightbox, you need to set images to “Link To:” media file. For image blocks, this setting is on the toolbar at the top of the block. For galleries, this setting is on the sidebar by other block options.</p>
<p><strong>LIGHTBOX DEMOS</strong></p>
<p><strong><a href="https://lightpress.io/free-lightbox/" rel="nofollow ugc">Free Lightbox Demo</a></strong><br />
<strong><a href="https://lightpress.io/pro-lightbox/" rel="nofollow ugc">Pro Lightbox Demo – Light Theme</a></strong><br />
<strong><a href="https://lightpress.io/pro-lightbox-dark/" rel="nofollow ugc">Pro Lightbox Demo – Dark Theme</a></strong></p>
<p><strong>FREE LIGHTBOX FEATURES</strong><br />
– Automatic detection of images and galleries<br />
– Customize colors of lightbox and navigation<br />
– Classic and modern navigation styles<br />
– Option to show info bar<br />
– Option to show title or alt text<br />
– Option to show download button<br />
– Slideshow options<br />
– Keyboard navigation<br />
– And more!</p>
<p>Links:<br />
-> <strong><a href="https://lightpress.io/free-lightbox/" rel="nofollow ugc">Demos</a></strong><br />
-> <strong><a href="https://lightpress.io/free-lightbox-documentation/" rel="nofollow ugc">Docs</a></strong><br />
-> <strong><a href="https://wordpress.org/support/plugin/wp-jquery-lightbox/" rel="ugc">Free Support</a></strong></p>
<p><strong>PRO LIGHTBOX FEATURES</strong></p>
<p>LightPress Pro is a premium extension for this lightbox plugin that offers:<br />
– Priority support via email directly from devs<br />
– <em>Powerful, Modern Pro Lighbox</em><br />
– Beautiful, modern full-browser and full-screen ligthbox<br />
– Dozens of customizations options<br />
– Thumbnails within the lightbox<br />
– Toolbar with controls for thumbnails, zoom, slideshow, and more<br />
– Open videos (Youtube, Vimeo, self-hosted)<br />
– Opens PDF files<br />
– Opens content from external web pages<br />
– Create easy modals and popup boxes<br />
– Open image maps<br />
– Flawless on mobile devices<br />
– Hyper fast performance</p>
<p>-> <strong><a href="https://lightpress.io/pro-lightbox/" rel="nofollow ugc">VIEW PRO LIGHTBOX DEMOS</a></strong><br />
-> <strong><a href="https://lightpress.io/contact/" rel="nofollow ugc">GET PRO SUPPORT</a></strong></p>
<p><strong>Background and Thanks</strong></p>
<p>Special thanks to <a href="http://www.ulfbenjaminsson.com" rel="nofollow ugc">Ulf Benjaminsson</a>, who created the original WP JQuery Lightbox plugin and maintained it for many years.</p>
<h3>Additional Info</h3>
<p>Copyright (C) 2010-2023 Ulf Benjaminsson.<br />
Copyright (C) 2023-Present LightPress LLC.</p>
<p>This program is free software; you can redistribute it and/or modify<br />
it under the terms of the GNU General Public License as published by<br />
the Free Software Foundation; either version 2 of the License, or<br />
(at your option) any later version.</p>
<p>This program is distributed in the hope that it will be useful,<br />
but WITHOUT ANY WARRANTY; without even the implied warranty of<br />
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the<br />
GNU General Public License for more details.</p>
<p>You should have received a copy of the GNU General Public License<br />
along with this program; if not, write to the Free Software<br />
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA</p>
WordPress Plugin Directory