ARI Fancy Lightbox WordPress Plugin Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the ARI Fancy Lightbox WordPress plugin, affecting versions prior to 1.3.9. The issue arises because the plugin does not properly sanitize and escape the 'msg' parameter before displaying it on an admin page.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the WordPress admin page for the ARI Fancy Lightbox plugin, including a 'msg' parameter with an injected script, such as an image tag with an 'onerror' event.

Remediation

Users are advised to update the ARI Fancy Lightbox WordPress plugin to version 1.3.9 or later.