What is the CVSS score of EUVD-2026-48462?

EUVD-2026-48462 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Firelight Lightbox EUVD-2026-48462

| CVE-2026-6454 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-24 Wordfence

GHSA-ccv6-5mc2-jm5q

PHP WordPress XSS Firelight Lightbox Wordpress Plugin Firelightwp

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Contributor-level auth required (PR:L); description states click-triggered execution (UI:R, correcting provided UI:N); injected JS executes in victim browser scope (S:C).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:03 vuln.today

CVE Published

Jul 24, 2026 - 02:31 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, where this.href is string-concatenated directly into an HTML string without escaping, allowing a stored href containing entity-encoded double-quotes to break out of the data attribute and inject arbitrary event handlers into the DOM. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user clicks the malicious PDF link.

AnalysisAI

Stored DOM Cross-Site Scripting in the Firelight Lightbox WordPress plugin (distributed as 'easy-fancybox') versions through 2.3.20 enables authenticated contributors to permanently embed arbitrary JavaScript into any WordPress page containing a PDF lightbox link. The flaw traces to FancyBox V2's beforeLoad callback in inc/fancybox-2.php, where this.href is concatenated into an HTML string without escaping, allowing entity-encoded double-quotes in a stored href to break out of the surrounding data attribute and attach arbitrary event handlers. CVSS scope-change scoring (S:C) reflects that successful exploitation compromises visiting users' browser sessions rather than the WordPress application itself, though the provided UI:N metric conflicts with the description's click-to-trigger requirement - a discrepancy that bears verification with Wordfence.

Technical ContextAI

The root cause is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) in PHP-generated JavaScript. At inc/fancybox-2.php line 322, the FancyBox V2 PDF beforeLoad callback constructs an HTML string by directly concatenating this.href - the stored href attribute of the PDF anchor element - without applying HTML entity encoding or JavaScript string escaping. When an attacker persists an href containing entity-encoded double-quotes (e.g., "), the browser decodes those entities during HTML parsing before attribute boundary evaluation, causing the decoded double-quote to prematurely close the surrounding data attribute. This allows the attacker to inject additional HTML attributes such as onclick, onmouseover, or other event handlers directly into the rendered DOM. The affected codebase is publicly visible at the WordPress SVN references (inc/fancybox-2.php line 322 and jquery.fancybox.js lines 280 and 1235). Affected product CPE: cpe:2.3:a:firelightwp:firelight_lightbox:*:*:*:*:*:*:*:* covering all versions up to and including 2.3.20.

RemediationAI

Update the Firelight Lightbox (easy-fancybox) plugin to a version beyond 2.3.20. A fix has been committed to the WordPress.org SVN repository at changeset 3610643 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3610643%40easy-fancybox&new=3610643%40easy-fancybox); however, the exact released plugin version containing this fix is not independently confirmed from available data - verify the current release via the WordPress admin plugin dashboard or the plugin's wordpress.org page before assuming any specific version number is patched. As a compensating control prior to patching, restrict contributor role assignment to fully trusted users on any multi-author site, since the attack requires that authentication level. Disabling the PDF lightbox feature entirely (if unused) eliminates the vulnerable code path with no functional trade-off for sites that do not serve PDF lightboxes. Deploying a Content Security Policy header that disallows inline event handlers will mitigate the impact of successful injection but requires careful tuning to avoid breaking other inline scripts present on the site.