CVE-2026-6454: Firelight Lightbox WordPress XSS Flaw

CVE-2026-6454 Overview

CVE-2026-6454 is a Stored DOM-based Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Firelight Lightbox (Easy Fancybox) plugin for WordPress in versions up to and including 2.3.20. The flaw resides in the FancyBox V2 PDF beforeLoad JavaScript callback generated by inc/fancybox-2.php, where the this.href value is concatenated directly into an HTML string without escaping. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript that executes when a user clicks a malicious PDF link.

Critical Impact

Contributor-level attackers can inject persistent JavaScript into published pages, enabling session theft, credential harvesting, and administrative account takeover through a single user click.

Affected Products

• Firelight Lightbox (Easy Fancybox) plugin for WordPress
• All versions up to and including 2.3.20
• WordPress sites permitting contributor-level or higher user registration

Discovery Timeline

• 2026-07-24 - CVE-2026-6454 published to the National Vulnerability Database
• 2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-6454

Vulnerability Analysis

The vulnerability is a Stored DOM-based XSS issue rooted in unsafe client-side HTML construction. The plugin generates a FancyBox V2 configuration in inc/fancybox-2.php that includes a beforeLoad callback for PDF content. Inside that callback, the current link's this.href property is string-concatenated into an HTML fragment that becomes part of the lightbox DOM.

Because the value is not passed through an escaping routine or safely assigned via textContent or a properly quoted attribute setter, attacker-controlled data can escape its intended attribute context. A stored href containing entity-encoded double quotes decodes at runtime and terminates the surrounding data attribute, allowing injection of arbitrary event handlers such as onmouseover or onclick directly into the rendered DOM.

The payload persists in post or page content authored by a contributor and executes in the browser of any visitor who interacts with the malicious PDF link. Execution occurs in the origin of the WordPress site, granting the attacker access to authenticated session cookies, nonces, and administrative interface actions if the victim holds elevated privileges.

Root Cause

The root cause is insufficient sanitization of the href attribute value before it is embedded into a JavaScript-generated HTML string. The vulnerable code path in inc/fancybox-2.php builds markup using string concatenation rather than safe DOM APIs, and does not apply HTML entity encoding to attacker-supplied URL data.

Attack Vector

Exploitation requires an authenticated account with contributor privileges or higher. The attacker publishes or submits content containing a specially crafted anchor whose href uses entity-encoded double quotes to break out of the intended attribute boundary. When any site visitor clicks the resulting PDF lightbox link, the injected event handler fires in the visitor's browser context.

The vulnerability manifests through unsafe string concatenation in a client-side callback. Refer to the WordPress Easy Fancybox PHP source and the Wordfence Vulnerability Report for the specific vulnerable lines.

Detection Methods for CVE-2026-6454

Indicators of Compromise

• Anchor tags in post or page content whose href targets .pdf URLs and contain HTML entities such as ", ", or encoded angle brackets.
• Unexpected inline event handler attributes (onclick, onmouseover, onerror) appearing in rendered DOM around FancyBox PDF links.
• Contributor or author accounts recently created with no legitimate editorial activity but posting content containing FancyBox-eligible links.
• Outbound browser requests from site visitors to unknown domains immediately after clicking a PDF lightbox link.

Detection Strategies

• Query the WordPress wp_posts table for post content matching regex patterns that combine .pdfhref values with encoded quote sequences.
• Inspect the rendered HTML of published pages for href attributes on FancyBox-classed anchors that contain encoded quotes or embedded JavaScript URI schemes.
• Review the plugin version deployed across all WordPress installations and flag any instance at or below 2.3.20.

Monitoring Recommendations

• Log and alert on new post or page publications by contributor and author roles, especially those containing anchor tags with .pdf targets.
• Deploy a Content Security Policy (CSP) that disallows inline event handlers and monitor CSP violation reports for attempted script execution.
• Track WordPress user role changes and privilege escalations that follow visits to affected pages by administrators.

How to Mitigate CVE-2026-6454

Immediate Actions Required

• Update the Firelight Lightbox (Easy Fancybox) plugin to a version above 2.3.20 as soon as a patched release is available.
• Audit existing post and page content for anchor tags with PDF targets containing encoded quote characters and remove or sanitize them.
• Restrict contributor and author account creation, and review recently registered accounts for suspicious activity.
• Rotate administrative session cookies and enforce password resets if exploitation is suspected.

Patch Information

A remediation commit is recorded in the plugin repository. See the WordPress Changeset Log for the vendor's fix and the Wordfence Vulnerability Report for advisory details. Administrators should upgrade to the fixed release published after version 2.3.20.

Workarounds

• Disable the Firelight Lightbox plugin until a patched version is installed if updates cannot be applied immediately.
• Remove the FancyBox V2 PDF handler from site configuration to prevent the vulnerable beforeLoad callback from being generated.
• Enforce a strict Content Security Policy that blocks inline event handlers to reduce exploitability of DOM-based XSS payloads.
• Temporarily downgrade contributor-eligible accounts to subscriber level to remove content-authoring capability.

# Configuration example: enforce CSP header via .htaccess to block inline handlers
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';"