CVE-2026-4379 is a stored cross-site scripting vulnerability in the LightPress Lightbox WordPress plugin (versions up to 2.3.4). The vulnerability occurs because the plugin modifies the output of the [gallery] shortcode to include the 'group' attribute value without proper escaping, allowing authenticated users with Contributor-level permissions or higher to inject arbitrary scripts. These scripts execute when any user accesses the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 score of 6.4, reflecting medium severity with network attack vector and low complexity. No official patch or remediation level is currently documented by the vendor.

An authenticated attacker with Contributor-level access or higher can inject persistent malicious scripts into pages via the 'group' attribute in the gallery shortcode. These scripts execute in the context of users viewing the affected pages, potentially compromising user sessions or performing unauthorized actions. The vulnerability does not affect availability and requires authentication, but the impact on confidentiality and integrity is low to moderate. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only to reduce the risk of exploitation. Avoid using the 'group' attribute in the [gallery] shortcode if possible. Monitor vendor communications for updates and apply patches promptly once available.