Firelight CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Firelight CVE published 2026-10-31

CVE-2026-118438

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content. This vulnerability could impact users viewing or previewing affected content and defenders should prioritize [truncated]