CVE-2026-6454 in Firelight Lightbox Plugin
Summary
by MITRE • 07/24/2026
The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, where this.href is string-concatenated directly into an HTML string without escaping, allowing a stored href containing entity-encoded double-quotes to break out of the data attribute and inject arbitrary event handlers into the DOM. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user clicks the malicious PDF link.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/24/2026
The Firelight Lightbox plugin for WordPress presents a critical stored DOM cross-site scripting vulnerability affecting versions through 2.3.20, representing a significant security risk for WordPress installations. This vulnerability stems from inadequate input sanitization within the FancyBox V2 PDF implementation, specifically in the beforeLoad JavaScript callback mechanism defined in the inc/fancybox-2.php file. The flaw manifests when the plugin processes href attribute values, failing to properly escape or sanitize user-supplied data before incorporating it into dynamically generated HTML content.
The technical execution of this vulnerability occurs through a sophisticated manipulation of HTML attribute handling within the JavaScript context. When a malicious href value containing entity-encoded double-quotes is stored and subsequently processed by the plugin's FancyBox implementation, the system concatenates this unescaped value directly into an HTML string without proper escaping mechanisms. This creates a condition where the encoded quotes can break out of their intended data attribute context and inject arbitrary event handlers into the Document Object Model. The vulnerability operates at the intersection of client-side JavaScript execution and server-side content processing, making it particularly dangerous as it allows attackers to inject malicious scripts that persist within the plugin's stored data.
Authentication requirements for exploitation are relatively low, as the vulnerability can be leveraged by authenticated attackers holding contributor-level privileges or higher within the WordPress environment. This access level provides sufficient permissions to upload and store malicious PDF links through the plugin's functionality, effectively bypassing many traditional content management security controls. The impact extends beyond simple script injection, as the stored malicious code executes automatically whenever any user clicks on the compromised PDF link, creating a persistent vector for attacks across multiple users within the same WordPress installation. This makes the vulnerability particularly dangerous in multi-user environments where contributor accounts may be less securely managed.
The operational implications of this vulnerability align with CWE-79, which defines cross-site scripting flaws as weaknesses that allow attackers to inject malicious scripts into web applications viewed by other users. The attack surface is further expanded through ATT&CK technique T1566, specifically focusing on the delivery of malicious payloads via compromised web content. The vulnerability essentially transforms legitimate plugin functionality into a weaponized attack vector, enabling attackers to perform session hijacking, credential theft, or redirection to malicious sites. This type of persistent XSS vulnerability also facilitates more sophisticated attacks such as keylogging or browser exploitation, depending on the attacker's objectives and the specific implementation details of the compromised WordPress environment.
Mitigation strategies should focus on immediate plugin version updates to address the core sanitization issues within the FancyBox V2 implementation. Organizations must implement strict input validation and output escaping for all user-supplied content processed by the plugin, particularly around href attribute handling. Security measures should include regular monitoring of stored content for malicious script injections and implementation of Content Security Policy headers to limit script execution capabilities. Additionally, privilege escalation controls should be enforced to restrict contributor-level access to plugin configuration options, reducing the attack surface available to potential adversaries. The vulnerability highlights the critical importance of input sanitization in JavaScript-heavy plugins and demonstrates how seemingly minor implementation flaws can create significant security risks in content management systems.