{"id":"CVE-2026-4805","aliases":["EUVD-2026-26005","GHSA-v7xm-65w9-h5rq"],"status":"published","title":"Woostify \u003c= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lity.js Library via data-lity Attribute in Custom HTML Block","description":"The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input sanitization and output escaping in the bundled Lity.js lightbox library, where user-controlled input from the href attribute is concatenated directly into a jQuery HTML string without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00206,"percentile":0.10734,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-04-28T06:45:46Z","modified":"2026-10-28T02:31:04Z","products":[{"vendor":"duongancol","product":"woostify"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/883ad6f7-e701-4708-b5d4-69b72ff38499?source=cve","tags":["web"]},{"url":"https://themes.trac.wordpress.org/browser/woostify/2.4.6/assets/js/lity.js#L142","tags":["web"]},{"url":"https://themes.trac.wordpress.org/browser/woostify/2.4.6/assets/js/lity.js#L611","tags":["web"]},{"url":"https://themes.trac.wordpress.org/browser/woostify/2.4.6/assets/js/lity.js#L635","tags":["web"]},{"url":"https://themes.trac.wordpress.org/browser/woostify/2.4.6/assets/js/lity.js#L163","tags":["web"]},{"url":"https://github.com/woostify/woostify/commit/a4669598aa8c5de344dda6c3d42389a3c2e61adc","tags":["fix"]},{"url":"https://themes.trac.wordpress.org/changeset?old_path=%2Fwoostify/2.5.0\u0026new_path=%2Fwoostify/2.5.1","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4805","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v7xm-65w9-h5rq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4805.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-4805","title":"Woostify \u003c= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lity.js Library via data-lity Attribute in Custom HTML Block","description":"The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input sanitization and output escaping in the bundled Lity.js lightbox library, where user-controlled input from the href attribute is concatenated directly into a jQuery HTML string without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-04-28T06:45:46.877Z","modified":"2026-04-28T14:12:31.748Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:59.369956Z"}],"euvd":[{"id":"EUVD-2026-26005","description":"The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input sanitization and output escaping in the bundled Lity.js lightbox library, where user-controlled input from the href attribute is concatenated directly into a jQuery HTML string without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-04-28T06:45:46Z","modified":"2026-04-28T14:12:31Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:16.972131Z"}],"ghsa":[{"id":"GHSA-v7xm-65w9-h5rq","title":"The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to,...","description":"The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input sanitization and output escaping in the bundled Lity.js lightbox library, where user-controlled input from the href attribute is concatenated directly into a jQuery HTML string without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-04-28T09:34:13Z","modified":"2026-04-28T09:34:19Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:07:40.70295Z"}],"nvd":[{"id":"CVE-2026-4805","description":"The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input sanitization and output escaping in the bundled Lity.js lightbox library, where user-controlled input from the href attribute is concatenated directly into a jQuery HTML string without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-04-28T08:16:01.8Z","modified":"2026-06-17T10:57:15.713Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:16.252509Z"}],"osv":[{"id":"CVE-2026-4805","title":"Woostify \u003c= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lity.js Library via data-lity Attribute in Custom HTML Block","description":"The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input sanitization and output escaping in the bundled Lity.js lightbox library, where user-controlled input from the href attribute is concatenated directly into a jQuery HTML string without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-04-28T06:45:46.877Z","modified":"2026-10-28T02:31:04.272441879Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:06.701612Z"}]}}