CVE-2026-4379: LightPress Lightbox WordPress XSS Flaw

CVE-2026-4379 Overview

The LightPress Lightbox plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the group attribute of the [gallery] shortcode. All versions up to and including 2.3.4 are affected by this security flaw. The vulnerability exists because the plugin modifies gallery shortcode output to include the group attribute value without proper escaping, enabling authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into pages that execute whenever a user accesses the compromised page.

Critical Impact

Authenticated attackers with minimal privileges can inject persistent malicious scripts that execute in the browsers of all users viewing affected pages, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

Affected Products

• LightPress Lightbox plugin for WordPress versions up to and including 2.3.4
• WordPress installations using the vulnerable wp-jquery-lightbox plugin
• Sites allowing Contributor-level or higher user access

Discovery Timeline

• April 8, 2026 - CVE-2026-4379 published to NVD
• April 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-4379

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability (CWE-79) resides in the LightPress Lightbox plugin's handling of the [gallery] shortcode. When the plugin processes gallery shortcodes, it incorporates the group attribute value directly into the rendered HTML output without applying proper sanitization or escaping. This allows malicious JavaScript code embedded in the attribute to be stored in the database and executed when any user views the page containing the compromised gallery.

The attack requires only Contributor-level access, which is a relatively low privilege threshold in WordPress environments. Once the malicious shortcode is saved, the injected script persists and executes in the context of any visitor's browser session, including administrators. This cross-scope impact makes the vulnerability particularly dangerous for multi-user WordPress installations.

Root Cause

The root cause is insufficient input validation and output encoding in the plugin's shortcode processing logic. Specifically, the vulnerability originates in the class-wp-jquery-lightbox.php file where the group attribute is processed at line 376 and output at line 395. The plugin fails to use WordPress escaping functions such as esc_attr() or esc_html() before rendering user-controlled data in HTML attributes, allowing script injection.

Attack Vector

The attack is network-based and requires authentication at the Contributor level or higher. An attacker must be able to create or edit posts containing the [gallery] shortcode. The malicious payload is crafted by inserting JavaScript code into the group attribute of the shortcode. For example, an attacker could inject event handlers or script tags that execute when the gallery is rendered.

The attacker creates a post or page with a malicious gallery shortcode containing JavaScript in the group attribute. When this content is saved and subsequently viewed by any user, including administrators, the injected script executes in their browser context. This enables the attacker to steal session cookies, perform actions on behalf of the victim, redirect users to malicious sites, or inject additional malicious content.

Detection Methods for CVE-2026-4379

Indicators of Compromise

• Posts or pages containing [gallery] shortcodes with suspicious group attribute values containing JavaScript event handlers like onload, onerror, or onclick
• Database entries in wp_posts table with gallery shortcodes containing encoded or obfuscated script content
• Unusual outbound network requests from visitor browsers to unfamiliar domains
• Reports of unexpected redirects or pop-ups on pages containing image galleries

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS patterns in shortcode attributes
• Perform regular database audits scanning for JavaScript patterns within shortcode content
• Enable WordPress debug logging and monitor for suspicious shortcode processing activity
• Deploy Content Security Policy (CSP) headers to detect and report inline script execution attempts

Monitoring Recommendations

• Monitor user activity logs for Contributors or Authors creating gallery shortcodes with unusual attribute values
• Set up alerts for new post/page creations containing the [gallery] shortcode with complex group attribute values
• Review browser console logs for Content Security Policy violations indicating script injection attempts
• Implement file integrity monitoring on the wp-jquery-lightbox plugin directory

How to Mitigate CVE-2026-4379

Immediate Actions Required

• Update the LightPress Lightbox (wp-jquery-lightbox) plugin to version 2.3.5 or later immediately
• Review all existing posts and pages containing [gallery] shortcodes for suspicious group attribute values
• Temporarily restrict Contributor access until the plugin is updated
• Audit user accounts with Contributor privileges or higher for unauthorized activity

Patch Information

The vulnerability has been addressed in version 2.3.5 of the plugin. The patch implements proper escaping of the group attribute value before it is included in the HTML output. Administrators should review the changeset between versions 2.3.4 and 2.3.5 to understand the specific fix. For detailed vulnerability analysis, consult the Wordfence threat intelligence report.

Workarounds

• Temporarily deactivate the LightPress Lightbox plugin until the update can be applied
• Restrict user role capabilities to prevent Contributors from using shortcodes (use a role management plugin)
• Implement server-side Content Security Policy headers to mitigate the impact of any injected scripts
• Deploy a WordPress security plugin with XSS filtering capabilities to sanitize shortcode output

# WordPress CLI commands to manage the vulnerability
# Update the plugin to the patched version
wp plugin update wp-jquery-lightbox

# Verify the installed version
wp plugin list --name=wp-jquery-lightbox --fields=name,version,status

# Temporarily deactivate if update is not immediately available
wp plugin deactivate wp-jquery-lightbox