EUVD-2026-48462
GHSA-ccv6-5mc2-jm5q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor-level auth required (PR:L); description states click-triggered execution (UI:R, correcting provided UI:N); injected JS executes in victim browser scope (S:C).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, where this.href is string-concatenated directly into an HTML string without escaping, allowing a stored href containing entity-encoded double-quotes to break out of the data attribute and inject arbitrary event handlers into the DOM. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user clicks the malicious PDF link.
AnalysisAI
Stored DOM Cross-Site Scripting in the Firelight Lightbox WordPress plugin (distributed as 'easy-fancybox') versions through 2.3.20 enables authenticated contributors to permanently embed arbitrary JavaScript into any WordPress page containing a PDF lightbox link. The flaw traces to FancyBox V2's beforeLoad callback in inc/fancybox-2.php, where this.href is concatenated into an HTML string without escaping, allowing entity-encoded double-quotes in a stored href to break out of the surrounding data attribute and attach arbitrary event handlers. CVSS scope-change scoring (S:C) reflects that successful exploitation compromises visiting users' browser sessions rather than the WordPress application itself, though the provided UI:N metric conflicts with the description's click-to-trigger requirement - a discrepancy that bears verification with Wordfence.
Technical ContextAI
The root cause is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) in PHP-generated JavaScript. At inc/fancybox-2.php line 322, the FancyBox V2 PDF beforeLoad callback constructs an HTML string by directly concatenating this.href - the stored href attribute of the PDF anchor element - without applying HTML entity encoding or JavaScript string escaping. When an attacker persists an href containing entity-encoded double-quotes (e.g., "), the browser decodes those entities during HTML parsing before attribute boundary evaluation, causing the decoded double-quote to prematurely close the surrounding data attribute. This allows the attacker to inject additional HTML attributes such as onclick, onmouseover, or other event handlers directly into the rendered DOM. The affected codebase is publicly visible at the WordPress SVN references (inc/fancybox-2.php line 322 and jquery.fancybox.js lines 280 and 1235). Affected product CPE: cpe:2.3:a:firelightwp:firelight_lightbox:*:*:*:*:*:*:*:* covering all versions up to and including 2.3.20.
RemediationAI
Update the Firelight Lightbox (easy-fancybox) plugin to a version beyond 2.3.20. A fix has been committed to the WordPress.org SVN repository at changeset 3610643 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3610643%40easy-fancybox&new=3610643%40easy-fancybox); however, the exact released plugin version containing this fix is not independently confirmed from available data - verify the current release via the WordPress admin plugin dashboard or the plugin's wordpress.org page before assuming any specific version number is patched. As a compensating control prior to patching, restrict contributor role assignment to fully trusted users on any multi-author site, since the attack requires that authentication level. Disabling the PDF lightbox feature entirely (if unused) eliminates the vulnerable code path with no functional trade-off for sites that do not serve PDF lightboxes. Deploying a Content Security Policy header that disallows inline event handlers will mitigate the impact of successful injection but requires careful tuning to avoid breaking other inline scripts present on the site.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today