Stored DOM Cross-Site Scripting in Firelight Lightbox Plugin for WordPress

CVE-2026-6454

What is CVE-2026-6454?

The Firelight Lightbox plugin for WordPress is exposed to a Stored DOM Cross-Site Scripting vulnerability in versions up to and including 2.3.20. This arises from inadequate sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback, specifically found in inc/fancybox-2.php. The vulnerability allows authenticated users with contributor-level access or higher to inject harmful web scripts into pages when a user interacts with a malicious PDF link, posing significant security risks. It's crucial for users to update their plugin to mitigate potential exploitation.

References