AIKIDO-2026-122349

TL;DR

Colorbox builds each gallery caption from the triggering element's title value and inserts it into the page with jQuery's .html(). Untrusted or externally influenced title text is rendered as raw HTML, so a < character in that value opens new markup or script tags inside the caption. Viewing a Colorbox item whose title contains such markup executes it in the page. The fix escapes < characters in the title before it is rendered.