CyberRota Analysis
AI-GeneratedThe Lightbox with PhotoSwipe WordPress plugin prior to version 5.9.0 is vulnerable due to inadequate sanitization of link data attributes, enabling users with author-level access to inject malicious JavaScript into image captions. This could lead to cross-site scripting (XSS) attacks, potentially compromising the security of visitors and administrators accessing the lightbox. WordPress site administrators and developers using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above (who lack the unfiltered_html capability) to store JavaScript that runs when a visitor or administrator opens the lightbox.