Threats tagged 'ghsa-jhjw-284v-p766'

The Lightbox & Modal Popup WordPress Plugin (FooBox) versions up to and including 2.8.7 are vulnerable to stored DOM-based cross-site scripting (XSS) via the 'img alt attribute inside .wp-caption container' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. Exploitation requires subscriber-level access if bbPress 2.6.20 is installed with a public forum and approved topics, or contributor-level access otherwise.