WordPress plugin

ARI Fancy Lightbox – Popup for WordPress security & vulnerabilities

Q: Does ARI Fancy Lightbox – Popup for WordPress have known vulnerabilities?

Yes. VulnCrest Radar lists 4 known vulnerabilities in ARI Fancy Lightbox – Popup for WordPress: 4 medium. At least one is not fixed in the latest version.

Q: How do I check which version of ARI Fancy Lightbox – Popup for WordPress I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

Q: What is the most recent ARI Fancy Lightbox – Popup for WordPress vulnerability?

CVE-2025-58784, published Sep 5, 2025: ARI Fancy Lightbox <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Q: Is any ARI Fancy Lightbox – Popup for WordPress vulnerability listed in CISA KEV?

No. None of the known ARI Fancy Lightbox – Popup for WordPress vulnerabilities is currently listed in the CISA KEV catalog.

ari-fancy-lightbox— active installsLast vulnerability Sep 5, 2025

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin

4Known vulnerabilities

Critical0
High0
Medium4
Low0

Vulnerabilities per year

All ARI Fancy Lightbox – Popup for WordPress vulnerabilities

ARI Fancy Lightbox – Popup for WordPress vulnerabilities
Severity	Vulnerability	CVE	Published
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.4.0Update to 1.4.1	CVE-2025-58784	Sep 5, 2025
Medium6.4	Authenticated (Author+) Stored Cross-Site Scripting ≤1.3.17Update to 1.3.18	CVE-2024-47310	Sep 25, 2024
Medium6.4	Arbitrary JavaScript Execution ≤0.21.5Update to 0.21.6	CVE-2024-4367	May 20, 2024
Medium6.1	Reflected Cross-Site Scripting <1.3.9Update to 1.3.9	CVE-2022-0161	Feb 17, 2022

Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.4.0Update to 1.4.1
CVE-2025-58784Sep 5, 2025
Medium6.4
Authenticated (Author+) Stored Cross-Site Scripting
≤1.3.17Update to 1.3.18
CVE-2024-47310Sep 25, 2024
Medium6.4
Arbitrary JavaScript Execution
≤0.21.5Update to 0.21.6
CVE-2024-4367May 20, 2024
Medium6.1
Reflected Cross-Site Scripting
<1.3.9Update to 1.3.9
CVE-2022-0161Feb 17, 2022

ARI Fancy Lightbox – Popup for WordPress: common questions

Does ARI Fancy Lightbox – Popup for WordPress have known vulnerabilities?

Yes. VulnCrest Radar lists 4 known vulnerabilities in ARI Fancy Lightbox – Popup for WordPress: 4 medium. At least one is not fixed in the latest version.

How do I check which version of ARI Fancy Lightbox – Popup for WordPress I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent ARI Fancy Lightbox – Popup for WordPress vulnerability?

CVE-2025-58784, published Sep 5, 2025: ARI Fancy Lightbox <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any ARI Fancy Lightbox – Popup for WordPress vulnerability listed in CISA KEV?

No. None of the known ARI Fancy Lightbox – Popup for WordPress vulnerabilities is currently listed in the CISA KEV catalog.