CVE-2025-5035

PoC —

CVSS 3.1

5.4 medium

EPSS

<1%p9

Published

Jun 27, 2025 (Jun 27, 2025)

Modified

Jun 17, 2026

Description

The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks.

Vendors: firelightwp
Products: firelight lightbox
Ecosystems: WordPress
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.