Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The LightPress Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `group` attribute in the `[gallery]` shortcode in all versions up to, and including, 2.3.4. This is due to the plugin modifying gallery shortcode output to include the `group` attribute value without proper escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
⚡ New CVE Alert: CVE-2026-4379 📊 Severity: 6.4 🚨 Risk Level: Medium 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4379 #CVE-2026-4379 #CVE #Medium #Wordpress #CyberSecurity #InfoSec https://t.co/UAJM4KQWk1
Post summary
The tweet announces the new CVE-2026-4379 affecting WordPress, with a medium severity of 6.4, and provides a reference to the NVD entry without any PoC, exploit, or patch information.
CVE-2026-4379 Stored Cross-Site Scripting in LightPress Lightbox Plugin ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4379 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet announces CVE‑2026‑4379 as a stored XSS flaw in the LightPress Lightbox Plugin and links to a detailed page, but no exploit, patch or active usage is discussed.
CVE-2026-4379 The LightPress Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `group` attribute in the `[gallery]` shortcode in all versions up to, … https://www.cve.org/CVERecord?id=CVE-2026-4379
Post summary
The statement announces a Stored XSS flaw in the LightPress Lightbox WordPress plugin, providing basic technical details and linking to the CVE record.