Read the docs

firelightwp

Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

firelightwp records in CISA KEV

No firelightwp vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Firelight Lightbox 3 records MEDIUM

Records

3 records in Firelight Lightbox · all components

TI-2025-03164 CVE-2025-3597 · GHSA-hhrx-pjm2-54m9

Firelight Lightbox < 2.3.15 - Contributor+ Stored XSS

Priority MEDIUM 60

The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00319 Published 2025-05-12 Fixed in 2.3.15
TI-2025-04514 CVE-2025-5035 · GHSA-3244-863h-59jf

Firelight Lightbox < 2.3.16 - Contributor+ Stored XSS

Priority MEDIUM 58

The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-S…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00234 Published 2025-06-27 Fixed in 2.3.16 CWE-79
TI-2024-33892 CVE-2024-50460 · GHSA-7m46-88q5-mp7g

WordPress Firelight Lightbox plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored XSS.This issue affects Firelight Lightbox: from n/a through <…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.0026 Published 2024-10-28 No fix listed CWE-79
Open these records in search →