Medium severity · published May 12, 2025
CVE-2025-3597
Firelight Lightbox < 2.3.15 - Contributor+ Stored XSS
5.9
CVSS
0.3%
EPSS
No
On KEV
Description
The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this feature is meant to only be available to Pro version users, it can be activated in the free version too, making it theoretically exploitable there as well.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Firelight Lightbox ·
before 2.3.15 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3597
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3597
Exploit
https://wpscan.com/vulnerability/8bf5e107-6397-4946-aaee-bf61d3e2dffd/
More from Firelight Lightbox
5.4
CVE-2025-5035
Firelight Lightbox < 2.3.16 - Contributor+ Stored XSS