What is GHSA-335m-jcx3-h636?

GHSA-335m-jcx3-h636 is a security advisory published by GitHub Security Advisories with Medium severity. The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens...

Which CVE IDs does GHSA-335m-jcx3-h636 cover?

GHSA-335m-jcx3-h636 covers the following CVE IDs: CVE-2026-118165. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-335m-jcx3-h636?

GHSA-335m-jcx3-h636 has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-335m-jcx3-h636MediumCVSS 6.8

The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens...

Vendor

GitHub Security Advisories

Published

October 30, 2026

Last Modified

October 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-118165 →

📋 Description

The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-118165
https://wpscan.com/vulnerability/345e7a47-ba72-4329-a9d6-9d3a9a8b3321
https://github.com/advisories/GHSA-335m-jcx3-h636