CVE-2025-3649 — LightPress Lightbox < 2.3.4 - Contributor+ Stored XSS

CVE-2025-3649

LightPress Lightbox < 2.3.4 - Contributor+ Stored XSS PUBLISHED

Description (CNA)

The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks.

Affected (CNA)

Vendor / product	Versions
Unknown / LightPress Lightbox	affected 0 before 2.3.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/37fb7f3b-1766-4c2c-9b78-f77f15a04476/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.