This vulnerability arises from improper neutralization of input during web page generation (CWE-79) in the SimpleLightbox library version 2.1.5 used by various WordPress plugins. Authenticated attackers with contributor or higher privileges can exploit insufficient input sanitization and output escaping on user-supplied attributes to inject stored malicious scripts. These scripts execute in the context of users viewing the compromised pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial impact on confidentiality and integrity.

The vulnerability allows authenticated users with contributor-level access or higher to perform stored cross-site scripting attacks, enabling arbitrary script execution in the browsers of users who access the injected pages. This can lead to partial confidentiality and integrity impacts, such as theft of user credentials or manipulation of page content. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or replacing the affected SimpleLightbox library in WordPress plugins. Monitor vendor channels for updates and apply patches promptly once released.