Firelightwp

7 CVEs across 3 Firelightwp products. Browse Firelightwp vulnerabilities, severities, and proof-of-concept exploits.

Firelightwp products with known CVEs

ProductCVEs
Firelight Lightbox3
Firelight Lightbox2
Lightpress Lightbox2
Firelightwp CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-6454Medium6.42026-07-24The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficien…
CVE-2026-4379Medium6.42026-04-08The LightPress Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `group` attribute in the `[gallery]` shortcode in all version…
CVE-2025-5035Medium5.42025-06-27The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users…
CVE-2025-3597Medium5.92025-05-12The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery…
CVE-2024-5020Medium6.42024-12-04Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in…
CVE-2024-50460Medium5.92024-10-28Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored…
CVE-2024-5425Medium6.42024-06-07The WP jQuery Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ attribute in all versions up to, and including, 1.5.4…