Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-49280: Lightbox Gallery plugin may let attackers run scripts

CVE-2024-49280 · published 2 years ago

Summary

The Lightbox slider – Responsive Lightbox Gallery plugin for WordPress (versions up to 1.10.6) can store malicious code that runs in a visitor's web browser. This lets an attacker display fake forms, steal data, or hijack user sessions when they view a page using the plugin. Update the plugin to the latest release or replace it with a secure alternative.

Original advisory text

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weblizar - WordPress Themes & Plugin Lightbox slider – Responsive Lightbox Gallery simple-lightbox-gallery allows Stored XSS.This issue affects Lightbox slider – Responsive Lightbox Gallery: from n/a through <= 1.10.6.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published17 Oct 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-49280 · NVD

Track software like this

Free during beta