CVE-2026-120687
Deferred Deferred - Pending Action

Stored DOM-Based XSS in FooBox WordPress Plugin

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: Wordfence

Description
The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute inside .wp-caption container' parameter in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users when bbPress is installed, as its bbp_filter_kses filter chain permits img and pre tags while preserving numeric character references inside attribute values, allowing encoded payloads to bypass save-time sanitization and reach the vulnerable sink fully intact. Exploitation by attackers with subscriber-level access and above requires that bbPress 2.6.20 is installed, a public forum exists, and either the first topic has already been approved or subsequent topics clear moderation. On a default installation, where that is not configured, the vulnerability requires attackers with contributor-level access and above.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-15
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-120687
EUVD
EUVD-2026-125938

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox From 0 (inc) to 2.8.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored DOM-Based Cross-Site Scripting (XSS) vulnerability in the FooBox WordPress plugin up to version 2.8.7. It occurs due to insufficient input sanitization and output escaping in the 'img alt attribute inside .wp-caption container' parameter. Attackers can inject malicious scripts into pages that execute when users access the infected page. Exploitation requires specific conditions like bbPress installation and user permissions.

Detection Guidance

Check for the FooBox WordPress plugin version 2.8.7 or lower. Inspect pages for injected scripts in img alt attributes within .wp-caption containers. Use WordPress admin to review plugin versions and scan for suspicious scripts in page content.

Impact Analysis

Unauthenticated attackers can inject arbitrary web scripts into pages. When users access these pages, the injected scripts execute, potentially stealing cookies, session tokens, or other sensitive data. Attackers with subscriber-level access or higher can exploit this if bbPress is installed and configured with public forums.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using this plugin may face compliance violations if exploited.

Mitigation Strategies

Update the FooBox plugin to the latest version. Remove bbPress if not needed. Restrict user roles to minimum required permissions. Monitor pages for unauthorized script injections and review moderation settings for forums.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120687. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...