Plugin security history

WP Video Lightbox Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 7 vulnerability records associated with WP Video Lightbox, published between 2014 and 2025.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

7Total records

0Critical

0High

7Medium

0Low

0Informational

7Patched records

0Currently marked unpatched

2014-08-01First disclosure

2025-07-02Latest disclosure

6 of 7CVE coverage

Use this history

Check and watch WP Video Lightbox.

A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.

Check my installed version Watch WP Video Lightbox

Year-by-Year Timeline

Year	Records	Relative volume
2014	1	1 records
2021	1	1 records
2022	3	3 records
2024	1	1 records
2025	1	1 records

Severity Breakdown

Severity	Records	Share
Medium	7	100%

Vulnerability-Type Breakdown

Cross-Site Scripting

7 records100%

First: 2014. Latest: 2025.

Patch Status

Patched: 7
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.9.12
1.9.11
1.9.7
1.9.6
1.9.5
1.9.3
1.7.5

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.9.11`	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library	July 2, 2025	1.9.12	Medium
`*-1.9.10`	WP Video Lightbox <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter	May 1, 2024	1.9.11	Medium
`*-1.9.6`	WP Video Lightbox <= 1.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	December 21, 2022	1.9.7	Medium
`*-1.9.5`	Video Lightbox <= 1.9.5 - Authenticated Stored Cross-Site Scripting	July 4, 2022	1.9.6	Medium
`*-1.9.4`	WP Video Lightbox <= 1.9.4 - Reflected Cross-Site Scripting	June 30, 2022	1.9.5	Medium
`*-1.9.2`	WP Video Lightbox <= 1.9.2 - Contributor+ Stored Cross-Site Scripting	August 23, 2021	1.9.3	Medium
`[*, 1.7.5)`	PrettyPhoto Library (Multiple Plugins and Themes) <= 3.1.4 - DOM Cross-Site Scripting	August 1, 2014	1.7.5	Medium

Selected source records

Latest Records

MediumCVE-2025-2540

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library

Published: July 2, 2025

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-1.9.11
Patched versions: 1.9.12

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-1.5.2
Patched versions: 1.5.3

Affected versions: *-1.8.6.6
Patched versions: 1.8.6.7

Original Wordfence record

MediumCVE-2024-4324

WP Video Lightbox <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter

Published: May 1, 2024

Affected versions: *-1.9.10
Patched versions: 1.9.11

Original Wordfence record

MediumCVE-2022-4465

WP Video Lightbox <= 1.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: December 21, 2022

Affected versions: *-1.9.6
Patched versions: 1.9.7

Original Wordfence record

Medium

Video Lightbox <= 1.9.5 - Authenticated Stored Cross-Site Scripting

Published: July 4, 2022

Affected versions: *-1.9.5
Patched versions: 1.9.6

Original Wordfence record

MediumCVE-2022-2189

WP Video Lightbox <= 1.9.4 - Reflected Cross-Site Scripting

Published: June 30, 2022

Affected versions: *-1.9.4
Patched versions: 1.9.5

Original Wordfence record

MediumCVE-2021-24665

WP Video Lightbox <= 1.9.2 - Contributor+ Stored Cross-Site Scripting

Published: August 23, 2021

Affected versions: *-1.9.2
Patched versions: 1.9.3

Original Wordfence record

MediumCVE-2013-6837

PrettyPhoto Library (Multiple Plugins and Themes) <= 3.1.4 - DOM Cross-Site Scripting

Published: August 1, 2014

Affected versions: [*, 7.5)
Patched versions: 7.5

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.4.12)
Patched versions: 1.4.12

Affected versions: [*, 0.4.17)
Patched versions: 0.4.17

Affected versions: [*, 5.5)
Patched versions: 5.5

Affected versions: [*, 1.7.5)
Patched versions: 1.7.5

Affected versions: [*, 1.2.7.5)
Patched versions: 1.2.7.5

Affected versions: [*, 2.1.3)
Patched versions: 2.1.3

Affected versions: [*, 4.1.1)
Patched versions: 4.1.1

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 3.0.229)
Patched versions: 3.0.229

Affected versions: [*, 3.1.5)
Patched versions: 3.1.5

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.1)
Patched versions: 1.1

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.2.0)
Patched versions: 1.2.0

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.1.7)
Patched versions: 2.1.7

Affected versions: [*, 6.6)
Patched versions: 6.6

Affected versions: [*, 2.0.0)
Patched versions: 2.0.0

Affected versions: [*, 4.6.1)
Patched versions: 4.6.1

Affected versions: [*, 2.0.227)
Patched versions: 2.0.227

Affected versions: [*, 1.1.7)
Patched versions: 1.1.7

Affected versions: [*, 3.3)
Patched versions: 3.3

Affected versions: [*, 2.11.8.18)
Patched versions: 2.11.8.18

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 0.0.8)
Patched versions: 0.0.8

Affected versions: *-0.1
Patched versions: 0.2

Affected versions: [*, 5.4)
Patched versions: 5.4

Affected versions: [*, 2.5.2)
Patched versions: 2.5.2

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Original Wordfence record

Highest-Severity Records

MediumCVE-2025-2540

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library

Published: July 2, 2025

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-1.9.11
Patched versions: 1.9.12

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-1.5.2
Patched versions: 1.5.3

Affected versions: *-1.8.6.6
Patched versions: 1.8.6.7

Original Wordfence record

MediumCVE-2024-4324

WP Video Lightbox <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter

Published: May 1, 2024

Affected versions: *-1.9.10
Patched versions: 1.9.11

Original Wordfence record

MediumCVE-2022-4465

WP Video Lightbox <= 1.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: December 21, 2022

Affected versions: *-1.9.6
Patched versions: 1.9.7

Original Wordfence record

MediumCVE-2013-6837

PrettyPhoto Library (Multiple Plugins and Themes) <= 3.1.4 - DOM Cross-Site Scripting

Published: August 1, 2014

Affected versions: [*, 7.5)
Patched versions: 7.5

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.4.12)
Patched versions: 1.4.12

Affected versions: [*, 0.4.17)
Patched versions: 0.4.17

Affected versions: [*, 5.5)
Patched versions: 5.5

Affected versions: [*, 1.7.5)
Patched versions: 1.7.5

Affected versions: [*, 1.2.7.5)
Patched versions: 1.2.7.5

Affected versions: [*, 2.1.3)
Patched versions: 2.1.3

Affected versions: [*, 4.1.1)
Patched versions: 4.1.1

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 3.0.229)
Patched versions: 3.0.229

Affected versions: [*, 3.1.5)
Patched versions: 3.1.5

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.1)
Patched versions: 1.1

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.2.0)
Patched versions: 1.2.0

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.1.7)
Patched versions: 2.1.7

Affected versions: [*, 6.6)
Patched versions: 6.6

Affected versions: [*, 2.0.0)
Patched versions: 2.0.0

Affected versions: [*, 4.6.1)
Patched versions: 4.6.1

Affected versions: [*, 2.0.227)
Patched versions: 2.0.227

Affected versions: [*, 1.1.7)
Patched versions: 1.1.7

Affected versions: [*, 3.3)
Patched versions: 3.3

Affected versions: [*, 2.11.8.18)
Patched versions: 2.11.8.18

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 0.0.8)
Patched versions: 0.0.8

Affected versions: *-0.1
Patched versions: 0.2

Affected versions: [*, 5.4)
Patched versions: 5.4

Affected versions: [*, 2.5.2)
Patched versions: 2.5.2

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2022-2189

WP Video Lightbox <= 1.9.4 - Reflected Cross-Site Scripting

Published: June 30, 2022

Affected versions: *-1.9.4
Patched versions: 1.9.5

Original Wordfence record

MediumCVE-2021-24665

WP Video Lightbox <= 1.9.2 - Contributor+ Stored Cross-Site Scripting

Published: August 23, 2021

Affected versions: *-1.9.2
Patched versions: 1.9.3

Original Wordfence record

Medium

Video Lightbox <= 1.9.5 - Authenticated Stored Cross-Site Scripting

Published: July 4, 2022

Affected versions: *-1.9.5
Patched versions: 1.9.6

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory