WP Colorbox
WP Colorbox has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for WP Colorbox has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. WP Colorbox is installed on roughly 5,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-49397Colorbox Lightbox <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
WP Colorbox
Author
Noor Alam
WP Colorbox plugin is a simple lightbox tool for WordPress. It allows users to pop up content in lightbox using the popular jQuery ColorBox library. They can also view the larger version of a particular media file without leaving the page. Features Beautiful lightbox popup style Flexiblity of creating your own lightbox link Pop up custom/HTML content in lightbox Trigger lightbox from either a text/image link Add lightbox to a YouTube or Vimeo video link Enable lightbox functionality on your site which supports modern browsers Use a simple shortcode to pop up a media file in lightbox Apply lightbox effect on images inserted into WordPress post/page Open external page in lightbox using iframe Responsive lightbox popup which works on mobile devices. Also it fits perfectly on smaller screens. How to Use WP Colorbox Pop up image in lightbox Create a new post/page and use the following shortcode to create a text/image link which will trigger lightbox once clicked: [wp_colorbox_media url="https://example.com/wp-content/uploads/images/overlay.jpg" type="image" hyperlink="click here to pop up image"] here, url is the link to the media file that you wish to open in lightbox and hyperlink is the anchor text/image. [wp_colorbox_media url="https://example.com/wp-content/uploads/images/overlay.jpg" type="image" hyperlink="http://example.com/wp-content/uploads/images/thumb.jpg"] Pop up YouTube video in lightbox [wp_colorbox_media url="https://www.youtube.com/embed/nmp3Ra3Yj24" type="youtube" hyperlink="click here to pop up youtube video"] Pop up Vimeo video in lightbox [wp_colorbox_media url="https://www.youtube.com/embed/1284237" type="vimeo" hyperlink="click here to pop up vimeo video"] Specify an Alternate Text for an Image [wp_colorbox_media url="https://example.com/wp-content/uploads/images/overlay.jpg" title="overlay image" type="image" hyperlink="http://example.com/wp-content/uploads/images/thumb.jpg" alt="Thumbnail image description"] Apply Custom CSS You can specify your own CSS class in the shortcode to customize a text/image link. [wp_colorbox_media url="https://www.youtube.com/embed/nmp3Ra3Yj24" type="youtube" hyperlink="click here to pop up youtube video" class="custom_class"] Multiple CSS classes can be separated with a space. For example: [wp_colorbox_media url="https://www.youtube.com/embed/nmp3Ra3Yj24" type="youtube" hyperlink="click here to pop up youtube video" class="custom_class custom_class2"] For detailed documentation please visit the WordPress Colorbox plugin page
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C