CVE-2026-14833: Lightbox with PhotoSwipe XSS Vulnerability

CVE-2026-14833 Overview

CVE-2026-14833 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Lightbox with PhotoSwipe WordPress plugin before version 5.9.0. The plugin fails to sanitize or escape a link data attribute before rendering it into the image lightbox caption in the browser. Authenticated users with author-level access or above, including those lacking the unfiltered_html capability, can inject JavaScript that executes when a visitor or administrator opens the lightbox. Exploitation can lead to session theft, administrator account takeover, or arbitrary actions performed in the context of the victim's browser.

Critical Impact
Authenticated authors can store JavaScript that executes in administrator browsers, enabling privilege escalation through session hijacking or forced administrative actions.

Affected Products

Lightbox with PhotoSwipe WordPress plugin versions prior to 5.9.0
WordPress sites permitting author-level or higher user registration
Any WordPress deployment using the vulnerable plugin to render image galleries

Discovery Timeline

2026-07-31 - CVE-2026-14833 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-14833

Vulnerability Analysis

The Lightbox with PhotoSwipe plugin generates lightbox captions by reading a link data attribute associated with image elements. The plugin injects the attribute value directly into the Document Object Model (DOM) without applying output escaping or sanitization. When a viewer opens the lightbox, the browser parses the attacker-controlled markup and executes any embedded JavaScript.

The issue falls under stored XSS because the malicious payload persists in post content or plugin-managed metadata. Every subsequent lightbox interaction retriggers the payload. WordPress normally restricts raw HTML input through the unfiltered_html capability, which authors do not hold. This vulnerability bypasses that restriction because the plugin re-renders the attribute client-side after WordPress sanitizes it server-side.

Root Cause

The root cause is missing output encoding when the plugin writes the link data attribute into the caption element. The plugin trusts the attribute value and uses an unsafe DOM assignment method, such as innerHTML, rather than textContent or a properly escaped equivalent. This design allows any HTML or script fragment stored in the attribute to execute in the caller's browser context.

Attack Vector

An authenticated user with author privileges creates or edits a post containing an image handled by the plugin. The attacker crafts a link data attribute containing JavaScript. When an administrator or site visitor opens the lightbox on that image, the payload runs with the privileges of the browsing user. High-value targets include administrator sessions, which allow the attacker to create new administrative accounts or modify plugin and theme files. User interaction is required because the payload only fires when the lightbox opens.

No verified public exploit code is available. Refer to the WPScan Vulnerability Advisory for further technical details.

Detection Methods for CVE-2026-14833

Indicators of Compromise

Unexpected <script> tags or JavaScript event handlers stored in post content or image metadata rendered by the plugin
New WordPress administrator accounts created shortly after an author-level user modified image galleries
Outbound requests from administrator browsers to unfamiliar domains after opening a lightbox gallery
Modifications to plugin or theme files that correlate with administrator sessions viewing image posts

Detection Strategies

Audit post content and postmeta tables for HTML attributes containing javascript:, onerror=, onload=, or <script fragments injected into image link attributes
Review WordPress activity logs for author-level users editing image blocks or gallery entries followed by administrator page views
Correlate browser telemetry from administrator endpoints with lightbox rendering URLs to identify unexpected script execution

Monitoring Recommendations

Enable a WordPress security or activity plugin that logs post edits and capability changes by non-administrator accounts
Deploy a Content Security Policy (CSP) that restricts inline script execution and report violations to a central log
Monitor endpoint EDR telemetry on administrator workstations for anomalous browser child processes or credential access following WordPress sessions

How to Mitigate CVE-2026-14833

Immediate Actions Required

Update the Lightbox with PhotoSwipe plugin to version 5.9.0 or later on all WordPress installations
Review author-level and contributor accounts, removing any that are unused or unrecognized
Inspect existing posts for suspicious link data attributes and remove injected payloads before restoring lightbox functionality
Rotate administrator credentials and invalidate active sessions if unauthorized modifications are found

Patch Information

The vendor released a fix in version 5.9.0 of the Lightbox with PhotoSwipe plugin. The patch introduces proper escaping of the link data attribute before it is rendered into the lightbox caption. Site administrators should apply the update through the WordPress plugin dashboard or via WP-CLI. Details are available in the WPScan Vulnerability Advisory.

Workarounds

Disable the Lightbox with PhotoSwipe plugin until the update to 5.9.0 can be applied
Restrict post creation and editing capabilities to trusted administrator accounts using a role management plugin
Deploy a web application firewall (WAF) rule that blocks HTML markup and script fragments submitted in image link fields
Enforce a strict Content Security Policy (CSP) that disallows inline JavaScript execution site-wide

bash

# Update the plugin using WP-CLI
wp plugin update lightbox-photoswipe --version=5.9.0

# Verify the installed version
wp plugin get lightbox-photoswipe --field=version