CVE-2026-6454 (GCVE-0-2026-6454)
Vulnerability from cvelistv5
Published
2026-07-24 02:31
Modified
2026-07-24 12:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, where this.href is string-concatenated directly into an HTML string without escaping, allowing a stored href containing entity-encoded double-quotes to break out of the data attribute and inject arbitrary event handlers into the DOM. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user clicks the malicious PDF link.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| firelightwp | Firelight Lightbox |
Version: 0 ≤ 2.3.20 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6454",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T12:22:27.655328Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T12:22:43.270Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Firelight Lightbox",
"vendor": "firelightwp",
"versions": [
{
"lessThanOrEqual": "2.3.20",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qu\u1ed1c Huy (jtwings)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, where this.href is string-concatenated directly into an HTML string without escaping, allowing a stored href containing entity-encoded double-quotes to break out of the data attribute and inject arbitrary event handlers into the DOM. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user clicks the malicious PDF link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T02:31:58.797Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8396c124-9c72-4801-8964-1cd5fbd52d20?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/trunk/inc/fancybox-2.php#L322"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/trunk/fancybox/2.2.0/jquery.fancybox.js#L280"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/trunk/fancybox/2.2.0/jquery.fancybox.js#L1235"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/tags/2.3.18/inc/fancybox-2.php#L322"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/tags/2.3.18/fancybox/2.2.0/jquery.fancybox.js#L280"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/tags/2.3.18/fancybox/2.2.0/jquery.fancybox.js#L1235"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3610643%40easy-fancybox\u0026new=3610643%40easy-fancybox"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-16T20:23:30.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T14:27:39.000Z",
"value": "Disclosed"
}
],
"title": "Firelight Lightbox \u003c= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad \u0027href\u0027 Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-6454",
"datePublished": "2026-07-24T02:31:58.797Z",
"dateReserved": "2026-04-16T20:08:18.705Z",
"dateUpdated": "2026-07-24T12:22:43.270Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-6454\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-24T12:22:27.655328Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-24T12:22:39.408Z\"}}], \"cna\": {\"title\": \"Firelight Lightbox \u003c= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad \u0027href\u0027 Attribute\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Qu\\u1ed1c Huy (jtwings)\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 6.4, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N\"}}], \"affected\": [{\"vendor\": \"firelightwp\", \"product\": \"Firelight Lightbox\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.3.20\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-16T20:23:30.000Z\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2026-07-23T14:27:39.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/8396c124-9c72-4801-8964-1cd5fbd52d20?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/easy-fancybox/trunk/inc/fancybox-2.php#L322\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/easy-fancybox/trunk/fancybox/2.2.0/jquery.fancybox.js#L280\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/easy-fancybox/trunk/fancybox/2.2.0/jquery.fancybox.js#L1235\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/easy-fancybox/tags/2.3.18/inc/fancybox-2.php#L322\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/easy-fancybox/tags/2.3.18/fancybox/2.2.0/jquery.fancybox.js#L280\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/easy-fancybox/tags/2.3.18/fancybox/2.2.0/jquery.fancybox.js#L1235\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3610643%40easy-fancybox\u0026new=3610643%40easy-fancybox\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, where this.href is string-concatenated directly into an HTML string without escaping, allowing a stored href containing entity-encoded double-quotes to break out of the data attribute and inject arbitrary event handlers into the DOM. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user clicks the malicious PDF link.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-07-24T02:31:58.797Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-6454\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-24T12:22:43.270Z\", \"dateReserved\": \"2026-04-16T20:08:18.705Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-07-24T02:31:58.797Z\", \"assignerShortName\": \"Wordfence\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…