Known vulnerabilities in ARI Fancy Lightbox – Popup for WordPress

Lightbox for WordPress with social and viral features. Show photos, gallery, PDF, videos, WooCommerce images, inline content, Google Maps links.

3Reported vulnerabilities

6.4Highest CVSS score

1.4.1Latest version

10,000+Active installs

What to do now

Update ARI Fancy Lightbox – Popup for WordPress to 1.4.1 or later. 3 of these have a fixed version available. Updating resolves them.

Plugin last updated: September 24, 2025 / Tested up to WordPress: 6.8.8 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2022-0161	Medium 6.1	0.9%	Before 1.3.9	`1.3.9`	March 14, 2022
CVE-2024-47310	Medium 6.4	0.3%	1.3.17 and earlier	`1.3.18`	September 25, 2024
CVE-2025-58784	Medium 6.4	0.2%	1.4.0 and earlier	`1.4.1`	September 5, 2025

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.