Firelightwp
Monthly
Stored DOM Cross-Site Scripting in the Firelight Lightbox WordPress plugin (distributed as 'easy-fancybox') versions through 2.3.20 enables authenticated contributors to permanently embed arbitrary JavaScript into any WordPress page containing a PDF lightbox link. The flaw traces to FancyBox V2's beforeLoad callback in inc/fancybox-2.php, where this.href is concatenated into an HTML string without escaping, allowing entity-encoded double-quotes in a stored href to break out of the surrounding data attribute and attach arbitrary event handlers. CVSS scope-change scoring (S:C) reflects that successful exploitation compromises visiting users' browser sessions rather than the WordPress application itself, though the provided UI:N metric conflicts with the description's click-to-trigger requirement - a discrepancy that bears verification with Wordfence.
LightPress Lightbox plugin for WordPress allows authenticated attackers with Contributor-level access and above to inject arbitrary JavaScript via the unescaped `group` attribute in the `[gallery]` shortcode, resulting in stored cross-site scripting that executes for all users viewing affected pages. The vulnerability affects all versions up to 2.3.4 and has been addressed in version 2.3.5.
The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks.
The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored XSS.3.3. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored DOM Cross-Site Scripting in the Firelight Lightbox WordPress plugin (distributed as 'easy-fancybox') versions through 2.3.20 enables authenticated contributors to permanently embed arbitrary JavaScript into any WordPress page containing a PDF lightbox link. The flaw traces to FancyBox V2's beforeLoad callback in inc/fancybox-2.php, where this.href is concatenated into an HTML string without escaping, allowing entity-encoded double-quotes in a stored href to break out of the surrounding data attribute and attach arbitrary event handlers. CVSS scope-change scoring (S:C) reflects that successful exploitation compromises visiting users' browser sessions rather than the WordPress application itself, though the provided UI:N metric conflicts with the description's click-to-trigger requirement - a discrepancy that bears verification with Wordfence.
LightPress Lightbox plugin for WordPress allows authenticated attackers with Contributor-level access and above to inject arbitrary JavaScript via the unescaped `group` attribute in the `[gallery]` shortcode, resulting in stored cross-site scripting that executes for all users viewing affected pages. The vulnerability affects all versions up to 2.3.4 and has been addressed in version 2.3.5.
The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks.
The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored XSS.3.3. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.