CVE-2026-13605

The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...

CVE-2026-13605

The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...

PT-2026-65692

The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfiltered html...

CVE-2026-66434

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

EUVD-2026-49243

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

CVE-2026-66434

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

CVE-2026-66434

Photonic Gallery & Lightbox for Flickr, SmugMug & Others WordPress plugin ≤ 3.33 is affected by a Cross Site Scripting (XSS) vulnerability. CVSSv3.1 base score 6.5 (MEDIUM) with network access, low privileges, user interaction required. Root cause and remediation details are not provided in the d...

CVE-2026-66434 WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.33 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.33 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Photonic Gallery & Lightbox for Flickr, SmugMug & Others versions = 3.33...

PT-2026-64963

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

CVE-2026-66434: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

CVE-2026-6454

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

CVE-2026-6454

CVE-2026-6454 affects the WordPress Firelight Lightbox plugin (versions up to 2.3.20). The root cause is improper sanitization of the href value in the FancyBox V2 PDF beforeLoad callback (inc/fancybox-2.php), where this.href is directly concatenated into HTML without escaping, allowing a stored ...

CVE-2026-6454 Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

EUVD-2026-48462

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

CVE-2026-6454

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

CVE-2026-6454 Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

PT-2026-64230

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

CVE-2026-6454: Improper Neutralization of Input During Web Page Generation

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

WordPress Firelight Lightbox plugin <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored DOM Cross-Site Scripting vulnerability discovered by Quốc Huy jtwings in WordPress Plugin Firelight Lightbox versions = 2.3.20...