Security Alert Summary
The Lightbox & Modal Popup WordPress Plugin – FooBox contains a stored DOM-based cross-site scripting (XSS) vulnerability in the handling of the img alt attribute inside the .wp-caption container. Insufficient input sanitization and output escaping can allow attackers to persist arbitrary script payloads that execute when a user opens an affected page. Exploitation is possible by Subscriber-level users when bbPress 2.6.20 is installed due to bbp_filter_kses behavior; on default installs where that is not configured, exploitation requires Contributor-level access or higher. Affected versions include all releases up to and including 2.8.7.
CVE Details
- CVE ID: CVE-2026-120687
- Affected component: Lightbox & Modal Popup WordPress Plugin – FooBox
- Affected versions: All versions up to and including 2.8.7
- Published: November 14, 2026 at 4:17:03 PM UTC
- Last modified: November 14, 2026 at 4:17:04 PM UTC
- CVSS v3.1: Base score 7.2, severity HIGH; vector string:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: No privileges required (PR:N); no user interaction required (UI:N). Attack vector: Network; Attack complexity: Low; Scope: Changed.
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The vulnerability is a stored DOM-based XSS stemming from insufficient input sanitization and output escaping of the img element’s alt attribute when placed inside a .wp-caption container. Malicious content saved into that attribute can reach a vulnerable sink and execute in a user’s browser when the page is viewed.
The report identifies that when bbPress is installed, the bbp_filter_kses filter chain permits img and pre tags while preserving numeric character references inside attribute values. This preservation allows encoded payloads to bypass save-time sanitization and arrive at the vulnerable output stage intact. Where bbPress 2.6.20 is present and a public forum allows Subscriber-level posting that results in saved content, subscribers can exploit the issue; otherwise, exploitation requires Contributor-level access or higher.
Impact is limited to execution of attacker-controlled script in the context of affected pages. The vulnerability does not, by itself, describe direct server-side command execution or availability disruption; its primary risks are client-side script execution leading to data exposure or session-based attacks.
How This Could Impact Your Website
Consider a site with a site owner, internal editors, and external contributors or forum participants. An attacker with Contributor-level access (or Subscriber-level when bbPress 2.6.20 is present and forum configuration permits) could save a crafted img alt value into a post or topic. When other users view that page, the injected script could run in their browsers.
Practical consequences include exposure of internal user email addresses or other data accessible via the user interface, and an increased risk of targeted phishing or social engineering against staff or contributors whose accounts or contact details are exposed. The issue is a client-side script execution risk and should be treated as a vector for data theft or session abuse rather than an automatic full-site compromise.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributors and Subscribers with write permissions.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your installation.
- Monitor site activity and content submissions for unusual behavior or unexpected HTML in user-submitted fields.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.8.7/free/includes/class-script-generator.php#L175
- https://plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.8.7/free/js/foobox.free.min.js
- https://plugins.trac.wordpress.org/changeset/3789888/foobox-image-lightbox
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3789888%40foobox-image-lightbox%2Ftags%2F2.8.8&old=3741260%40foobox-image-lightbox%2Ftags%2F2.8.7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/66b5a5a2-8f70-4a85-ad03-8bd159cafdf5?source=cve
