CVE-2026-4379 is a stored cross-site scripting vulnerability in the LightPress Lightbox plugin for WordPress. The issue occurs because the plugin modifies the output of the [gallery] shortcode to include the 'group' attribute without properly escaping its value. This allows authenticated attackers with Contributor-level privileges or above to inject arbitrary web scripts into pages. These scripts execute in the context of users who access the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 2.3.4.

Successful exploitation allows an authenticated user with Contributor or higher privileges to inject persistent malicious scripts into WordPress pages. These scripts execute in the browsers of users who view the infected pages, potentially leading to information disclosure or user session compromise. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Monitor for plugin updates from firelightwp and apply any official patches promptly once released.