CVE-2025-3597
Medium
Description
The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this feature is meant to only be available to Pro version users, it can be activated in the free version too, making it theoretically exploitable there as well.
SeverityMedium
CVSS5.9
Exploit probability—
ProductFirelightwp Firelight Lightbox
PublishedMay 12, 2025
First seenMay 12, 2025
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- firelightwp firelight_lightbox2.3.15 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| firelightwp firelight_lightbox | v < 2.3.15 | 2.3.15 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.