1. Home
  2. CVE Database
  3. CVE-2025-3597
MEDIUM · 5.9

CVE-2025-3597

The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this ...

Vulnerability Description

The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this feature is meant to only be available to Pro version users, it can be activated in the free version too, making it theoretically exploitable there as well.

CVSS Score

5.9

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
FirelightwpFirelight Lightbox< 2.3.15

References

FAQ

What is CVE-2025-3597?

CVE-2025-3597 is a vulnerability with a CVSS score of 5.9 (MEDIUM). The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this ...

How severe is CVE-2025-3597?

CVE-2025-3597 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-3597?

Check the references section above for vendor advisories and patch information. Affected products include: Firelightwp Firelight Lightbox.