CVE-2024-50460

CVE-2024-50460 describes a Stored XSS in the Firelight Lightbox WordPress plugin (≤ 2.3.3). The vulnerability arises from improper neutralization of input during web page generation, enabling attacker-supplied input to be stored and served to users. Public references cite CVSS scores around 4.8–5...

CVE-2025-3597

The Firelight Lightbox WordPress plugin (versions prior to 2.3.15 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure to prevent users with post writing capabilities from executing arbitrary JavaScript when the jQuery Metadata library is enabled. Although this...

CVE-2025-5035

The Firelight Lightbox WordPress plugin (versions prior to 2.3.16 ) is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper sanitization and escaping of title attributes before they are outputted on the page. This allows users with a role as low as contributors to execute mali...