Firelight Lightbox Security & Risk Analysis

The Easy Fancybox plugin, version 2.3.19, exhibits a mixed security posture. Static analysis reveals a small attack surface with no immediate unprotected entry points, and the presence of nonce and capability checks on its AJAX handlers is a positive sign. However, a significant concern arises from its SQL query handling, where 100% of the single identified query is not using prepared statements. This lack of proper sanitization for SQL interactions, even with a single query, introduces a risk of SQL injection vulnerabilities if the input is not rigorously validated elsewhere.

The plugin's vulnerability history is particularly concerning, with a total of 5 known CVEs, all classified as medium severity and related to Cross-Site Scripting (XSS). The fact that these vulnerabilities are all marked as 'currently unpatched' is a critical red flag. While the last vulnerability was recorded in 2025, indicating it might be a future date, the pattern of repeated XSS vulnerabilities suggests a recurring issue with input sanitization and output escaping, despite static analysis showing a relatively high percentage (73%) of properly escaped outputs. The complete absence of taint analysis results could either mean the tool found nothing or was not effectively applied to uncover potential issues, making the vulnerability history the primary indicator of deeper, persistent problems.

In conclusion, while Easy Fancybox has a small attack surface and implements some basic security checks, the unpatched XSS vulnerabilities and the use of raw SQL queries without prepared statements present considerable risks. The plugin's past indicates a pattern of insecurity that users should be aware of. The high number of past vulnerabilities, even if medium severity, should be a strong deterrent until they are definitively addressed.