Home

Description

The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.

PUBLISHED Reserved 2025-04-16 | Published 2025-06-30 | Updated 2025-06-30 | Assigner WPScan

Problem types

CWE-79 Cross-Site Scripting (XSS)

Product status

Default status
unaffected

Any version before 3.0.6.8
affected

Credits

Pierre Rudloff finder

WPScan coordinator

References

wpscan.com/...rability/1b50f686-c2e0-4963-95c8-b27137dcc059/ exploit vdb-entry technical-description

cve.org (CVE-2025-3745)

nvd.nist.gov (CVE-2025-3745)

Download JSON