The Lightbox with PhotoSwipe WordPress plugin versions prior to 5.9.0 contain a stored XSS vulnerability (CWE-79). The flaw arises because the plugin does not properly sanitize or escape a link data attribute before rendering it into the image lightbox caption in the browser. This enables users with author-level privileges and above, who do not have the unfiltered_html capability, to store malicious JavaScript code. The injected script executes when a visitor or administrator opens the affected lightbox, potentially leading to compromise of confidentiality, integrity, and availability.

Successful exploitation allows an attacker with author-level access to inject and execute arbitrary JavaScript in the context of the site for visitors and administrators. This can lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level user capabilities and avoid granting untrusted users author-level access. Monitor for plugin updates and apply them promptly once released.