CVE-2026-14833

Name of the Vulnerable Software and Affected Versions Lightbox with PhotoSwipe versions prior to 5.9.0

Description Insufficient sanitization and escaping of a link data attribute before it is rendered into the image lightbox caption allows users with author-level access and above, who lack the unfiltered html capability, to perform a stored cross-site scripting attack. This occurs when a visitor or administrator opens the lightbox, executing the stored JavaScript in their browser.

Recommendations Update to version 5.9.0 or later.