The Firelight Lightbox plugin is vulnerable to a stored DOM‑level XSS flaw. Unsanitized data from the href attribute in the FancyBox V2 PDF beforeLoad callback is concatenated directly into an HTML string, enabling an authenticated contributor‑level attacker to inject entity‑encoded double quotes that break the attribute context and place arbitrary event handlers in the resulting DOM. When a user clicks the malicious PDF link, the injected script runs in the victim’s browser, allowing the attacker to execute code in that context. This represents a classic DOM‑based XSS vulnerability (CWE‑79).

All web sites that use the Firelight Lightbox WordPress plugin version 2.3.20 or earlier are affected. Site administrators should verify the currently installed plugin version; any installation of this product at the specified or lower versions falls within the vulnerable range.

The CVSS score of 6.4 denotes a moderate severity flaw that requires authenticated access at the contributor level or higher. The EPSS score of less than 1% indicates a very low likelihood of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to first obtain sufficient privileges to create or edit PDF links and then craft a malicious href attribute that includes entity‑encoded double quotes. When a victim later clicks such a link, the injected script executes. The practical risk is limited to users who interact with the compromised content, but the flaw can be leveraged for malicious client‑side activity once the XSS is triggered.