CVE-2026-6454

Name of the Vulnerable Software and Affected Versions Firelight Lightbox versions prior to 2.3.21

Description Stored DOM Cross-Site Scripting occurs due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in the inc/fancybox-2.php file. The this.href variable is concatenated directly into an HTML string without escaping, which allows a stored href containing entity-encoded double-quotes to break out of the data attribute and inject arbitrary event handlers into the Document Object Model (DOM). Authenticated attackers with contributor-level access and above can use this to inject arbitrary web scripts into pages that execute when a user clicks a malicious PDF link.

Recommendations Update to a version newer than 2.3.20.