Firelight Lightbox

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 63% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

1. ★★★★★ Anonymous

   1mo ago

   great plugin that does exactly what it claims

   Read on wp.org ↗
2. ★★★★★ starstudio

   1mo ago

   It has just the right features—nothing more, nothing less—and runs smoothly; I am satisfied.

   Read on wp.org ↗
3. ★★★★★ streetcruiserdk

   2mo ago

   Its fine and good

   Read on wp.org ↗
4. ★★★★★ psychofsky

   2mo ago

   It works fine! Easy and simple.

   Read on wp.org ↗
5. ★★★★★ joerndaberkow

   2mo ago

   Many thanks for this plugin. It runs without errors and does exactly what it’s supposed to. Perfect!

   Read on wp.org ↗
6. ★★★★★ yuerohin

   2mo ago

   Давно пользуюсь, всё что нужно есть, без нареканий

   Read on wp.org ↗
7. ★★★★★ ahawtin

   3mo ago

   Works perfectly with no issues. Thank you!

   Read on wp.org ↗
8. ★★★★★ xdya

   3mo ago

   Flawless

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 2.3.22 Fix: FancyBox 2 PDF dimensions 2.3.22
2. — Version 2.3.21 Update: bundled DOMPurify to 3.4.12 2.3.21
3. — Version 2.3.20 PDFs: Impove PDF embed handlers in Legacy, Classic, and V2 lightboxes 2.3.20
4. — Version 2.3.19 Fix: Remove unused Fancybox .old JS files 2.3.19
5. — Version 2.3.18 Update: Supported WordPress version 2.3.18
6. — Version 2.3.17 Fix: Improve image attribute handling Fix: Update dom purify version 2.3.17

7 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 6.4 Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute ↗
   2026-07-23 CVE-2026-6454 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.3.20 Patched in 2.3.21
2. Medium · 6.4 Firelight Lightbox <= 2.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2025-06-19 CVE-2025-52707 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.3.16 Patched in 2.3.17
3. Medium · 6.4 Firelight Lightbox <= 2.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2025-06-06 CVE-2025-5035 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.3.15 Patched in 2.3.16
4. Medium · 6.4 Firelight Lightbox <= 2.3.14 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2025-04-21 CVE-2025-3597 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.3.14 Patched in 2.3.15
5. Medium · 6.4 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library ↗
   2024-12-03 CVE-2024-5020 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.3.3 Patched in 2.3.4
6. Medium · 6.4 Firelight Lightbox <= 2.3.3 - Authenticated (Author+) Stored Cross-Site Scripting ↗
   2024-10-24 CVE-2024-50460 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.3.3 Patched in 2.3.4
7. Medium · 5.5 Easy Fancybox <= 1.8.17 - Authenticated Stored Cross-Site Scripting ↗
   2019-09-25 CVE-2019-16524 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.17 Patched in 1.8.18

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 45 languages, 4 at 90% or more

Plus 21 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2023-07-14 300K+ → 200K+ down after 2 days in tier
2. 2023-07-12 200K+ → 300K+ up after 1 days in tier
3. 2023-07-11 300K+ → 200K+ down after 2 days in tier
4. 2023-07-09 200K+ → 300K+ up after 1 days in tier
5. 2023-07-08 300K+ → 200K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• LightPress Lightbox 40K+ installs · 4.5★ · 4 shared tags A
• WP Colorbox 5K+ installs · 4.2★ · 4 shared tags B
• Responsive Lightbox & Gallery 100K+ installs · 4.9★ · 3 shared tags A
• S Simple Lightbox 100K+ installs · 4.3★ · 3 shared tags B
• Lightbox & Modal Popup WordPress Plugin – FooBox 100K+ installs · 3.9★ · 3 shared tags B
• Lightbox for Gallery & Image Block 20K+ installs · 4.9★ · 3 shared tags A

Embed this report card

Drop a live Pulse card for Firelight Lightbox into a readme, a review or a deck. It updates itself.

Firelight Lightbox: 200K+ active installs, 4.8★ (355 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/easy-fancybox