WordPress plugin

Firelight Lightbox security & vulnerabilities

Q: Is any Firelight Lightbox vulnerability listed in CISA KEV?

No. None of the known Firelight Lightbox vulnerabilities is currently listed in the CISA KEV catalog.

easy-fancybox— active installsLast vulnerability Oct 29, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin

9Known vulnerabilities

Critical0
High0
Medium9
Low0

Vulnerabilities per year

All Firelight Lightbox vulnerabilities

Firelight Lightbox vulnerabilities
Severity	Vulnerability	CVE	Published
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting ≤2.3.23Update to 2.3.24	CVE-2026-118438	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting ≤2.3.22Update to 2.3.23	CVE-2026-118165	Oct 28
Medium6.4	Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute ≤2.3.20Update to 2.3.21	CVE-2026-6454	Jul 23
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting ≤2.3.16Update to 2.3.17	CVE-2025-52707	Jun 19, 2025
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting ≤2.3.15Update to 2.3.16	CVE-2025-5035	Jun 6, 2025
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting ≤2.3.14Update to 2.3.15	CVE-2025-3597	Apr 21, 2025
Medium6.4	Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library ≤3.59.4Update to 3.59.5	CVE-2024-5020	Dec 3, 2024
Medium6.4	Authenticated (Author+) Stored Cross-Site Scripting ≤2.3.3Update to 2.3.4	CVE-2024-50460	Oct 24, 2024
Medium5.5	Authenticated Stored Cross-Site Scripting ≤1.8.17Update to 1.8.18	CVE-2019-16524	Sep 25, 2019

Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.3.23Update to 2.3.24
CVE-2026-118438Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.3.22Update to 2.3.23
CVE-2026-118165Oct 28
Medium6.4
Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute
≤2.3.20Update to 2.3.21
CVE-2026-6454Jul 23
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.3.16Update to 2.3.17
CVE-2025-52707Jun 19, 2025
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.3.15Update to 2.3.16
CVE-2025-5035Jun 6, 2025
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.3.14Update to 2.3.15
CVE-2025-3597Apr 21, 2025
Medium6.4
Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library
≤3.59.4Update to 3.59.5
CVE-2024-5020Dec 3, 2024
Medium6.4
Authenticated (Author+) Stored Cross-Site Scripting
≤2.3.3Update to 2.3.4
CVE-2024-50460Oct 24, 2024
Medium5.5
Authenticated Stored Cross-Site Scripting
≤1.8.17Update to 1.8.18
CVE-2019-16524Sep 25, 2019

Firelight Lightbox: common questions

Does Firelight Lightbox have known vulnerabilities?

Yes. VulnCrest Radar lists 9 known vulnerabilities in Firelight Lightbox: 9 medium. At least one is not fixed in the latest version.

How do I check which version of Firelight Lightbox I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Firelight Lightbox vulnerability?

CVE-2026-118438, published Oct 29, 2026: Firelight Lightbox <= 2.3.23 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any Firelight Lightbox vulnerability listed in CISA KEV?

No. None of the known Firelight Lightbox vulnerabilities is currently listed in the CISA KEV catalog.