CVE-2025-3597

The Firelight Lightbox WordPress plugin (versions prior to 2.3.15 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure to prevent users with post writing capabilities from executing arbitrary JavaScript when the jQuery Metadata library is enabled. Although this...

CVE-2025-3597 Firelight Lightbox < 2.3.15 - Contributor+ Stored XSS

The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this feature is meant to only be available to Pro version users, it can be activated in the free versi...

CVE-2025-3597 Firelight Lightbox < 2.3.15 - Contributor+ Stored XSS

The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this feature is meant to only be available to Pro version users, it can be activated in the free versi...

PT-2025-20682 · WordPress · Lightpress Lightbox

Name of the Vulnerable Software and Affected Versions: LightPress Lightbox plugin for WordPress versions prior to 2.3.4 Description: The issue allows users with at least the contributor role to conduct Stored XSS attacks due to the plugin not checking if download links point to valid,...

WordPress plugin LightPress Lightbox 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin Firelight Lightbox 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-20681 · WordPress +1 · Firelight Lightbox +1

Name of the Vulnerable Software and Affected Versions: Firelight Lightbox plugin for WordPress versions prior to 2.3.15 Description: The issue allows users with post writing capabilities to execute arbitrary JavaScript when the jQuery Metadata library is enabled. This feature is intended for Pro...

CVE-2025-3649: Improper Neutralization of Input During Web Page Generation

The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks...

CVE-2025-3597: Undefined Security Weakness

The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this feature is meant to only be available to Pro version users, it can be activated in the free versi...

CVE-2025-32139

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FooPlugins FooBox Image Lightbox foobox-image-lightbox.This issue affects FooBox Image Lightbox : from n/a through = 2.7.33...

CVE-2025-32139

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FooPlugins FooBox Image Lightbox foobox-image-lightbox.This issue affects FooBox Image Lightbox : from n/a through = 2.7.33...

CVE-2025-32139

CVE-2025-32139 refers to the WordPress plugin FooBox Image Lightbox (Lightbox) with an authenticated stored XSS vulnerability (Improper Neutralization of Input During Web Page Generation) affecting FooBox Image Lightbox versions from n/a up to 2.7.33. The Red Hat/Wordfence entries corroborate: vu...

WordPress plugin FooBox Image Lightbox 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

PT-2025-15932

Name of the Vulnerable Software and Affected Versions: FooBox Image Lightbox versions through 2.7.33 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for potentially malicious scripts to be injected...

CVE-2025-32139: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FooPlugins FooBox Image Lightbox foobox-image-lightbox.This issue affects FooBox Image Lightbox : from n/a through = 2.7.33...

WordPress plugin Team Circle Image Slider With Lightbox SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

PT-2025-15362

Name of the Vulnerable Software and Affected Versions: Team Circle Image Slider With Lightbox plugin for WordPress versions 1.0.4 and earlier Description: The issue arises from insufficient escaping of the user-supplied id parameter and lack of sufficient preparation on the existing SQL query,...

CVE-2019-25223: Improper Neutralization of Special Elements used in an SQL Command

The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2025-32176

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows Stored XSS.This issue affects SimpLy Gallery: from n/a through = 3.2.5...

CVE-2025-32176

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows Stored XSS.This issue affects SimpLy Gallery: from n/a through = 3.2.5...