{"cve":"CVE-2025-3597","nvd":{"published":"2025-05-12T06:15:39.030","modified":"2026-06-17T09:20:16.267","status":"Analyzed","description":"The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this feature is meant to only be available to Pro version users, it can be activated in the free version too, making it theoretically exploitable there as well.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","score":5.9},"cwes":[],"references":["https://wpscan.com/vulnerability/8bf5e107-6397-4946-aaee-bf61d3e2dffd/"],"products":["firelightwp:firelight_lightbox"],"source":"nvd","synced_at":"2026-10-19T22:01:22.920403922+00:00"},"epss":{"cve":"CVE-2025-3597","score":0.00319,"percentile":0.24959,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}