CVE-2026-14833: Unknown Lightbox With Photoswipe

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above (who lack the unfiltered_html capability) to store JavaScript that runs when a visitor or administrator opens the lightbox.

Affected products

• Unknown Lightbox With Photoswipe: before 5.9.0 (fixed in 5.9.0)

Published 2026-07-31. Last modified 2026-08-26.