Vulnerability record
CVE-2026-120687
The short answer
CVE-2026-120687 affects fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox and is rated high (CVSS 7.2). It is not in CISA's Known Exploited Vulnerabilities catalog.
What it is
The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute inside .wp-caption container' parameter in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users when bbPress is installed, as its bbp_filter_kses filter chain permits img and pre tags while preserving numeric character references inside attribute values, allowing encoded payloads to bypass save-time sanitization and reach the vulnerable sink fully intact. Exploitation by attackers with subscriber-level access and above requires that bbPress 2.6.20 is installed, a public forum exists, and either the first topic has already been approved or subsequent topics clear moderation. On a default installation, where that is not configured, the vulnerability requires attackers with contributor-level access and above.
Weakness: CWE-79.
Severity
7.2 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Exploited (CISA KEV)
Not listed
CISA lists confirmed exploitation only
EPSS, next 30 days
No score
FIRST scores CVEs within a day of publication
How it can be exploited
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality impact
- Low
- Integrity impact
- Low
- Availability impact
- None
Affected products
Lightbox & Modal Popup WordPress Plugin – FooBox. NVD's record lists the exact affected versions.
References
- plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.8.7/free/includes/class-script-generator.php#L175
- plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.8.7/free/js/foobox.free.min.js
- plugins.trac.wordpress.org/changeset/3789888/foobox-image-lightbox
- plugins.trac.wordpress.org/changeset?reponame=&new=3789888%40foobox-image-lightbox%2Ftags%2F2.8.8&old=3741260%40foobox-image-lightbox%2Ftags%2F2.8.7
- www.wordfence.com/threat-intel/vulnerabilities/id/66b5a5a2-8f70-4a85-ad03-8bd159cafdf5?source=cve
Questions
Is CVE-2026-120687 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog as of 2026-11-14.
How do I fix CVE-2026-120687?
Follow the vendor advisory in the references below. NVD lists the affected versions under its configurations.
From NVD, CISA KEV, FIRST EPSS and OSV.dev, checked . Status on NVD: Deferred. The description is NVD's text, quoted as published.
Related
Newly exploited vulnerabilities, every Monday
What CISA added to its KEV catalog that week, and the Critical CVEs most likely to be exploited. One email a week, one click to stop.
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.