WP jQuery Lightbox, CVE-2025-3649

CVE, Research URL: CVE-2025-3649
Home page URL: Security reports for WP jQuery Lightbox
Application: WP jQuery Lightbox
Published on: May 12, 2025
Research Description: The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks.
Affected versions: max 2.3.4.
Status: vulnerable