PT-2025-27410 · WordPress · Wp Lightbox 2

Name of the Vulnerable Software and Affected Versions: WP Lightbox 2 versions prior to 3.0.6.8 Description: The issue concerns the incorrect sanitization of the title attribute in links, potentially allowing malicious users to conduct cross-site scripting XSS attacks. Recommendations: For version...

CVE-2025-3745: Improper Neutralization of Input During Web Page Generation

The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks...

WordPress plugin WP Lightbox 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2025-5093

The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2025-5035

The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks...

CVE-2025-5035

The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks...

CVE-2025-5093

The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2025-5093 Responsive Lightbox & Gallery < 2.5.2 - Contributor+ Stored XSS

The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2025-5093 Responsive Lightbox & Gallery < 2.5.2 - Contributor+ Stored XSS

The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2025-5035 Firelight Lightbox < 2.3.16 - Contributor+ Stored XSS

The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks...

CVE-2025-5035 Firelight Lightbox < 2.3.16 - Contributor+ Stored XSS

The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks...

CVE-2025-5035

The Firelight Lightbox WordPress plugin (versions prior to 2.3.16 ) is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper sanitization and escaping of title attributes before they are outputted on the page. This allows users with a role as low as contributors to execute mali...

CVE-2025-5093: Improper Neutralization of Input During Web Page Generation

The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

WordPress plugin Firelight Lightbox 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-27052 · WordPress +1 · Responsive Lightbox & Gallery +1

Name of the Vulnerable Software and Affected Versions: Responsive Lightbox & Gallery WordPress plugin versions prior to 2.5.2 Description: The issue concerns the use of the Swipebox library in the Responsive Lightbox & Gallery WordPress plugin, which fails to validate and escape title attributes...

PT-2025-27051 · WordPress · Firelight Lightbox

Name of the Vulnerable Software and Affected Versions: Firelight Lightbox WordPress plugin versions prior to 2.3.16 Description: The issue concerns the Firelight Lightbox WordPress plugin, which does not properly sanitise and escape title attributes before displaying them on the page. This could...

CVE-2025-5035: Improper Neutralization of Input During Web Page Generation

The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks...

WordPress plugin Responsive Lightbox & Gallery 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2025-52707

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored XSS.This issue affects Firelight Lightbox: from n/a through = 2.3.16...

CVE-2025-52707

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored XSS.This issue affects Firelight Lightbox: from n/a through = 2.3.16...