Ari Fancy Lightbox Vulnerabilities

The ARI Fancy Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pag...

CVSS:

6.4

Affected:

up to 1.4.0

Fixed in:

1.4.1

Disclosed:

Sep 5, 2025

CVE-2025-58784 on NVD →

The ARI Fancy Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages t...

CVSS:

6.4

Affected:

up to 1.3.17

Fixed in:

1.3.18

Disclosed:

Sep 25, 2024

CVE-2024-47310 on NVD →

PDF.js is vulnerable to Arbitrary JavaScript Execution in versions prior to 4.2.67. This is due to a missing type check when handling fonts. This makes it possible for authenticated attackers, with contributor-level or above permissions, to execute arbitrary JavaScript if they can successfully trick a user into opening...

CVSS:

6.4

Affected:

up to 1.3.14

Fixed in:

1.3.15

Disclosed:

May 20, 2024

CVE-2024-4367 on NVD →

The ARI Fancy Lightbox WordPress plugin before 1.3.9 does not sanitise and escape the msg parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

CVSS:

6.1

Affected:

up to 1.3.9

Fixed in:

1.3.9

Disclosed:

Feb 17, 2022

CVE-2022-0161 on NVD →