What the vulnerability does
01Description
The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, where this.href is string-concatenated directly into an HTML string without escaping, allowing a stored href containing entity-encoded double-quotes to break out of the data attribute and inject arbitrary event handlers into the DOM. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user clicks the malicious PDF link.
Explanation of Vulnerability in Simple Terms
02Summary
Firelight Lightbox versions 2.3.20 and earlier contain a cross-site scripting vulnerability that allows authenticated users to inject malicious scripts. The vulnerability has a changed scope, meaning the impact can extend beyond the lightbox component itself. An attacker with low-level site access can craft payloads affecting other users or site functionality.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that executes in other users' browsers or affects site functionality.
Potential impact on your site
04Site Impact
Authenticated users can inject scripts affecting other visitors or site behavior; potential for credential theft or malware distribution.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account on the site; no user interaction required.
Key dates
06Disclosure timeline
July 24, 2026
CVE published
