← Database

CVE-2025-3649

MEDIUM CVSS: 6.8 Published: 2025-05-12 Modified: 2026-06-17

Description

The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks.

Affected Platforms

Lightpress Lightbox

Weakness Type

CWE-79

References