Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: firelightwp Component: Firelight Lightbox Clear all filters
TI-2025-04514 CVE-2025-5035 · GHSA-3244-863h-59jf

Firelight Lightbox < 2.3.16 - Contributor+ Stored XSS

Priority MEDIUM 58

The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-S…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00234 Published 2025-06-27 Fixed in 2.3.16 CWE-79
TI-2025-03164 CVE-2025-3597 · GHSA-hhrx-pjm2-54m9

Firelight Lightbox < 2.3.15 - Contributor+ Stored XSS

Priority MEDIUM 60

The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00319 Published 2025-05-12 Fixed in 2.3.15
TI-2024-33892 CVE-2024-50460 · GHSA-7m46-88q5-mp7g

WordPress Firelight Lightbox plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored XSS.This issue affects Firelight Lightbox: from n/a through <…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.0026 Published 2024-10-28 No fix listed CWE-79