CVE-2026-3347

Summary

The Multi Functional Flexi Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the arv_lb[message] parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This is due to the arv_lb_options_val() sanitize callback returning user input without any sanitization, and the stored message value being output in the genLB() function without escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page or post with the lightbox enabled.

Affected Software

VendorProductVersion RangeStatus
arevicoMulti Functional Flexi Lightbox0 <= 1.2affected

Weaknesses

  • CWE-79: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References