CVE-2024-50460

CVE-2024-50460 describes a Stored XSS in the Firelight Lightbox WordPress plugin (≤ 2.3.3). The vulnerability arises from improper neutralization of input during web page generation, enabling attacker-supplied input to be stored and served to users. Public references cite CVSS scores around 4.8–5...

CVE-2025-3597

CVE-2025-3597 affects the Firelight Lightbox WordPress plugin for versions prior to 2.3.15. The vulnerability lets users with post-writing capabilities execute arbitrary Javascript when the jQuery Metadata library is enabled, a feature intended for Pro but which can be activated in the free versi...

CVE-2025-5035

The Firelight Lightbox WordPress plugin is vulnerable to a stored Cross-Site Scripting (XSS) attack in versions prior to 2.3.16 . The root cause is the failure to properly sanitise and escape title attributes before they are outputted on the page. This flaw allows users with privileges as low as ...