Firelight Lightbox
Firelight Lightbox has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; all 7 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 7 of the records (100%).
Every one of the 7 issues recorded for Firelight Lightbox has a vendor fix available, so running the current release closes all known holes.
6 independent researchers contributed these findings, most of them (2) reported by Pierre Rudloff. Firelight Lightbox is installed on roughly 200,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2026-6454Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute
Read the full analysisVulnerability Records
Firelight Lightbox
Author
Firelight
NEWS: Easy Fancybox is now Firelight Lightbox. Read about it here. Firelight Lightbox is the most popular lighbox plugin for WordPress, active on over 200,000 WordPress installations. It adds a lightweight and flexible lightbox for viewing images, video, and other media on your website. After activation, links to images, galleries, videos, pdfs, maps, modals, etc, will open in a lightbox. Settings will be under ‘Lightbox’ on your main admin menu. QUICK LIGHTBOX DEMOS Demos for images, videos, PDFs, maps, and modals/popups: Free Lightbox Demo Pro Lightbox Demo – Light Theme Pro Lightbox Demo – Dark Theme FREE LIGHTBOX FEATURES – Automatic detection of images – Automatic detection of galleries – Customize options for Lightbox appearance, style, and behavior – Opens all common image formats including webp and svg – Opens WordPress core galleries – Opens videos from Youtube, Vimeo, and Dailmotion – Opens PDF files (embed with object tag, iframe, external Google Docs Viewer) – Opens NextGEN galleries (instructions) – Opens content from external web pages (instructions) – Create easy modals and popup boxes (instructions) – Open image maps (instructions) – Open lightbox from WordPress menu items (instructions) – Support for Jetpack Infinite Scroll – Support for WordPress Multsite (see Installation instructions) Links: -> Demos -> Docs -> Free Support PRO LIGHTBOX FEATURES Firelight Lightbox Pro is an extension for this lightbox plugin that offers: – Dozens of Pro features for free lightboxes (Fancybox Legacy, Classic, V2) – Priority support direct from developers – New and Powerful Pro Lighbox based on Fancybox 5, including: – Beautiful, modern full-browser and full-screen ligthbox – 100+ customizations options – Thumbnails within the lightbox – Social sharing for images – Link direct to images in the lightbox – “Download image” button – Toolbar with controls for thumbnails, social sharing, zoom, slideshow, etc – Open videos – Open PDFs – Open popups – Open inline content and iframes – Open Google maps – NextGEN Gallery integration – Elementor integration – Perfect on mobile devices – Optimized lightbox speed -> VIEW PRO LIGHTBOX DEMOS -> GET PRO SUPPORT GDPR / EU Privacy This plugin does not collect any data or set any browser cookies. The PRO version offers an option to disable the automatic popup after the first visit, which needs a browser cookie. This cookie stores the visitors first website visit timestamp and path on the client side. It is not shared nor is any data stored server side or elsewhere. Contribute If you’re happy with this plugin, please consider writing a quick rating, helping others in the forum, or translating. Known conflicts & issues See Firelight Lightbox Troubleshooting.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C