Lightbox with PhotoSwipe < 5.9.0 – Author+ Stored XSS via data-lbwps-caption Attribute | CVE 2026-14833

Description

The plugin does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above (who lack the unfiltered_html capability) to store JavaScript that runs when a visitor or administrator opens the lightbox.

Proof of Concept

Prerequisites: the plugin is active with default options (caption display is enabled by default). The attacker holds an Author account (a Contributor can also store the payload; it then executes when an Editor/Administrator previews the pending post and clicks the link). The victim is any visitor or administrator who opens the lightbox by clicking the captioned link.

1. Log in as the Author and upload any image to the Media Library (Authors have upload_files). Note its URL, e.g. https://victim.example/wp-content/uploads/2026/07/image.jpg

2. Create and publish a post containing this link. The data-lbwps-caption value is written HTML-entity-encoded so it survives wp_kses_post; the plugin decodes it back when it builds the caption:

   <a href="https://victim.example/wp-content/uploads/2026/07/image.jpg" data-lbwps-caption="&lt;img src=x onerror=alert(document.domain)&gt;">Click me</a>

3. Visit the published post on the front end and click "Click me". The lightbox opens and the caption payload executes alert(document.domain) in the browser of whoever clicked (an administrator click runs it in the wp-admin session).

No separate <img> element is needed: the caption fires from the <a> link itself once the plugin treats it as a lightbox item. No-upload variant (also works for a Contributor): add data-lbwps-width="800" data-lbwps-height="600" to the <a> and use any image href, so the explicit dimensions make the link a lightbox item without the server having to fetch the image.