VulnerabilityAnalyzed

CVE-2025-3597

The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled.

MEDIUM 5.9EPSS 0.31%

Does this matter?

Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own.

Description

The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this feature is meant to only be available to Pro version users, it can be activated in the free version too, making it theoretically exploitable there as well.

CVSS 3.1: 5.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
EPSS: 0.31% probability · 23th percentile
CISA KEV: Not listed
Affected: firelightwp/firelight lightbox
Source: contact@wpscan.com

References

https://wpscan.com/vulnerability/8bf5e107-6397-4946-aaee-bf61d3e2dffd/Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.