Stored Cross-Site Scripting in Lightbox with PhotoSwipe WordPress Plugin

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Lightbox with PhotoSwipe WordPress plugin versions before 5.9.0. It occurs because the plugin does not properly sanitize or escape the data-lbwps-caption attribute in image links. Users with author-level access or higher can inject malicious JavaScript into captions. When the lightbox is opened, the script executes in the browser of visitors or administrators.

Useful 0 Not Useful 0

Detection Guidance

Check if the Lightbox with PhotoSwipe plugin version is below 5.9.0. Inspect WordPress posts for links with the data-lbwps-caption attribute containing suspicious JavaScript payloads. Use commands like grep -r 'data-lbwps-caption' /path/to/wordpress to search for affected links.

Useful 0 Not Useful 0

Impact Analysis

If you are a WordPress site administrator or user with author-level access, an attacker could exploit this to inject malicious scripts. These scripts could steal cookies, session tokens, or sensitive data, redirect users to malicious sites, or perform actions on behalf of the user. Visitors to the site could have their sessions compromised or be exposed to phishing attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, exposing personal or sensitive data. Under GDPR, this may result in fines for failing to protect user data. For HIPAA, it could compromise protected health information, leading to compliance violations and penalties. Organizations must address this to maintain regulatory compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Lightbox with PhotoSwipe plugin to version 5.9.0 or later. Remove any untrusted user-generated content with malicious scripts. Restrict author-level access to prevent further exploitation.

Useful 0 Not Useful 0