Source evidence

Security issue?

ARI Fancy Lightbox – Popup for WordPress · support · 2024-06-28T12:53:00+00:00

ARI Fancy Lightbox – Popup for WordPress plugin evidence original source source API

neutralsentiment

highseverity

0.7relevance

5replies

Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

7 / 36 rows with source links

19.4% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

29 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support

espressivo resolved

Will this be patched soon? https://patchstack.com/database/vulnerability/ari-fancy-lightbox/wordpress-ari-fancy-lightbox-plugin-1-3-14-cross-site-scripting-xss-vulnerability?_a_id=431 Hi It will be fixed immediately when receive details from PatchStack team about the issue. I have the same problem and would like to have that fixed soon: Category:PLUGIN Versions-Affected:<= 1.3.14 Type:Cross Site Scripting Severity:MEDIUM Description:This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. PDFJS library was updated to the latest version in “ARI Fancy Lightbox” v. 1.3.15. It looks like the plugin was just removed from WordPress, thought it was patched? This makes me a bit concerned. Can you offer any insight into what is going on? This reply was modified 1 year, 10 months ago by JoeStraz . The issue was fixed in v. 1.3.15. You can see it in original report on PatchStack site. The plugin is temporary removed by WordPress team to re-run review process. Hope it will be returned back soon.

Commercial Context

Opportunity

onsite conversion and engagement operations

Popup conversion widget assurance for turning onsite engagement widgets into measurable leads, trust, and conversions

Buyer: marketing teams, agencies, publishers, and ecommerce operators

Wedge: audit popup display rules, lead capture, trust signals, and campaign attribution

Proof Blocked card complete market

Analysis

heuristic-v1

Summary: Security issue?: users show security, bugs, performance pain that may indicate a product gap.

Evidence quote: Security issue?

Affected feature: security

security bugs performance missing feature

Plugin

API

ARI Fancy Lightbox – Popup for WordPress

10.0K active installs · 244.5K downloads · rating 94.0

fancybox fancybox3 lightbox popup video lightbox

Comments

5 shown

arisoft 2024-06-28T13:43:00+00:00

Hi It will be fixed immediately when receive details from PatchStack team about the issue.

R2Y Mediamatik 2024-07-03T09:17:00+00:00

I have the same problem and would like to have that fixed soon: Category:PLUGIN Versions-Affected:<= 1.3.14 Type:Cross Site Scripting Severity:MEDIUM Description:This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.

arisoft 2024-07-05T08:48:00+00:00

PDFJS library was updated to the latest version in “ARI Fancy Lightbox” v. 1.3.15.

JoeStraz 2024-07-10T02:33:00+00:00

It looks like the plugin was just removed from WordPress, thought it was patched? This makes me a bit concerned. Can you offer any insight into what is going on? This reply was modified 1 year, 10 months ago by JoeStraz .

arisoft 2024-07-11T04:54:00+00:00

The issue was fixed in v. 1.3.15. You can see it in original report on PatchStack site. The plugin is temporary removed by WordPress team to re-run review process. Hope it will be returned back soon.