CVE-2024-3276: 
WordPress vulnerability analysis and mitigation

The Lightbox & Modal Popup WordPress Plugin (both free and premium versions) before version 2.7.28 contains a stored Cross-Site Scripting (XSS) vulnerability. This security issue affects high-privilege users such as administrators, allowing them to perform Stored XSS attacks even when the unfiltered_html capability is disallowed, such as in multisite setups (WPScan).

The vulnerability stems from improper sanitization and escaping of certain plugin settings. The CVSS v3.1 base score is 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

When exploited, this vulnerability could allow authenticated administrators to inject and execute malicious JavaScript code in the context of other users' browsers, potentially leading to unauthorized actions or data theft, even in environments where unfiltered HTML is explicitly disallowed (WPScan).

The vulnerability can be exploited by accessing the plugin settings and modifying the "Specific CSS classes" field with malicious JavaScript code. A proof of concept involves changing this field to '123"alert(1)'. The attack requires administrative privileges to execute (WPScan).

Users should update to version 2.7.28 or later of either the free (foobox-image-lightbox) or premium (foobox-image-lightbox-premium) versions of the plugin to address this vulnerability (WPScan).