CVE-2024-50460: 
WordPress vulnerability analysis and mitigation

The Firelight Lightbox WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2024-50460) affecting versions up to and including 2.3.3. The vulnerability was discovered by Robert DeVore and publicly disclosed on October 24, 2024 (WPScan, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and stems from insufficient input sanitization and output escaping in the plugin. The CVSS v3.1 scores vary between sources, with NVD rating it at 4.8 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, while Patchstack assigns a score of 5.9 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability allows authenticated attackers with author-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized access to sensitive information or manipulation of website content (WPScan).

The vulnerability has been patched in version 2.3.4 of the Firelight Lightbox plugin. Users are advised to update to this version or later to resolve the security issue (Patchstack).