What’s Vulnerable › Products

Firelight Lightbox vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your Firelight Lightbox version is affected

Latest Firelight Lightbox vulnerabilities

• CVE-2026-6454 — Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute (CVSS 6.4)
• CVE-2025-5035 — Firelight Lightbox < 2.3.16 - Contributor+ Stored XSS (CVSS 5.4)
• CVE-2025-52707 — WordPress Firelight Lightbox plugin <= 2.3.16 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
• CVE-2025-3597 — Firelight Lightbox < 2.3.15 - Contributor+ Stored XSS (CVSS 5.9)
• CVE-2024-5020 — Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library (CVSS 6.4)
• CVE-2024-50460 — WordPress Firelight Lightbox plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 4.8)