CVE-2026-124649
Lightbox with PhotoSwipe < 5.19.0 - Unauthenticated Stored XSS via Comment Link Title
CVE-2026-124649 is a vulnerability with no CVSS score yet in Unknown Lightbox With Photoswipe, published November 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. No source names a fixed version.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- 0.17%EPSS, 6th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link titles and other caption sources before inserting them as HTML into the image lightbox caption, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks via comments.
Exploit likelihood
Affected products
What each source reports
CVE ListNo score
Lightbox with PhotoSwipe < 5.19.0 - Unauthenticated Stored XSS via Comment Link Title
The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link titles and other caption sources before inserting them as HTML into the image lightbox caption, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks via comments.
- Record
CVE-2026-124649- Updated
- 2026-11-14
EUVDEUVD-2026-125866No score
The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link titles and other caption sources before inserting them as HTML into the image lightbox caption, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks via comments.
- Record
EUVD-2026-125866- Updated
- 2026-11-14
GitHub AdvisoriesGHSA-qjhw-rmf9-g548No score
The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link...
The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link titles and other caption sources before inserting them as HTML into the image lightbox caption, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks via comments.
- Record
GHSA-qjhw-rmf9-g548- Updated
- 2026-11-14
NVDNo score
The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link titles and other caption sources before inserting them as HTML into the image lightbox caption, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks via comments.
- Record
CVE-2026-124649- Updated
- 2026-11-14
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD, NVD | |
| published | EUVD | |
| aliases, references | GitHub Advisories | |
| references, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.