Firelight Lightbox vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

FL

Product

Firelight Lightbox

by firelightwp · last CVE Jul 24, 2026

5

CVEs

0

On KEV

6.4

Max CVSS

0

New 30D

Vulnerabilities5 In the news0 Timeline

Severity mix

Critical 0High 0Medium 5Low 0

Severity

All severities5 Critical0 High0 Medium5 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Firelight Lightbox to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-6454	6.4	0%	Jul 24	Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute Affected: through 2.3.20
CVE-2024-5020	6.4	0%	Dec 4	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library Affected: through 2.3.3
CVE-2025-3597	5.9	0%	May 12	Firelight Lightbox < 2.3.15 - Contributor+ Stored XSS Affected: before 2.3.15
CVE-2025-5035	5.4	0%	Jun 27	Firelight Lightbox < 2.3.16 - Contributor+ Stored XSS Affected: before 2.3.16
CVE-2024-50460	4.8	0%	Oct 28	WordPress Firelight Lightbox plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability Affected: before 2.3.4