What Firelight Lightbox does on your site
Firelight Lightbox, long known as Easy FancyBox (it was renamed in version 2.3.0), opens links to images, galleries, videos, PDFs or on-page content in an overlay window, a “lightbox.” Once activated, it automatically detects links to JPG, PNG, WebP and JPEG images, groups the images of a WordPress gallery so visitors can browse through them, and takes over Image and Gallery blocks, even when they have no link. Everything else is switched on type by type: PDF, SVG, YouTube, Vimeo, Dailymotion, inline content (to build a modal window), iFrames and external pages.
Settings live under the “Lightbox” menu in the admin. The first choice is the display script, from three versions of the FancyBox library bundled with the plugin: FancyBox Classic Reloaded (the default), FancyBox V2 and FancyBox Legacy, the oldest one and the only one that still opens SWF files. In the block editor, a “Lightbox” panel shows the active lightbox and links to the settings. All of these scripts rely on jQuery.
The developer, Firelight, took over the plugin with version 1.9.7. It sells Firelight Pro, an add-on that sits on top of the free version: the Lite plan adds Pro features to the three free lightboxes, while the higher plans bring a new “Pro Lightbox” built on Fancybox 5, with thumbnails, sharing, zoom, full screen and slideshow.
Which sites Firelight Lightbox is a good fit for
Firelight Lightbox makes sense when your images and media are already in your pages and you just want them to open large, without rebuilding your galleries:
- Blogs and editorial sites: images and native galleries open large as soon as the plugin is active, with no need to edit your posts.
- Sites that publish PDFs or videos: brochures or YouTube videos display without leaving the page.
- Sites running NextGEN Gallery: the developer documents how to open NextGEN Gallery galleries in its lightbox.
- Multisite networks: the plugin can be activated network-wide or site by site; when network-activated, it lets each site pick its own media types.
It is not the best choice if you want to build galleries (grids, albums, filters): a gallery plugin such as Envira Gallery or Modula handles that, with its own lightbox. And if all you need is to enlarge images, the “Expand on click” option of the WordPress Image block does the job without a plugin, though it opens neither PDFs nor videos.
Firelight Lightbox strengths and limitations
Strengths
- Works right after activation. Links to images and native galleries open in a lightbox with no setup at all.
- Plenty of media types for free. Images, PDFs, SVG, YouTube, Vimeo, Dailymotion, modal windows and iFrames at no cost.
- Privacy-friendly. According to the developer, the plugin collects no data and sets no cookies, and there is a privacy mode for YouTube.
- Fine-grained control. A list of selectors to exclude and a
nolightboxclass for links that should stay normal.
Limitations
- Scripts on every page. As soon as one media type is enabled, jQuery and FancyBox load everywhere, even with no image to open.
- The modern lightbox is paid. Thumbnails, zoom, sharing and full screen require the Pro Lightbox, which the Lite plan lacks.
- A crowded settings screen. Three scripts with different options, incomplete translations and prompts to upgrade to Pro.
- Recurring XSS flaws. Several vulnerabilities patched in 2025 and 2026, exploitable from a contributor account.
The settings we recommend for Firelight Lightbox
Everything is set on the Lightbox screen in the admin menu. The plugin’s labels are only partly translated, so non-English sites may see some of them in English.
| Setting | Recommended value | Why |
|---|---|---|
| Choose Your Lighbox (sic) Lightbox, top of the screen | FancyBox Classic Reloaded (default), or FancyBox V2 for the Retina display option | Legacy is only worth it to open old SWF files. |
| Enable for Images Lightbox > Global settings > Enable | On (default) | This is the plugin’s main job. |
| Other media types (Enable for PDFs, Enable for Youtube...) Same section | Only the ones you publish | Each enabled type adds automatic link detection: fewer surprises on links that should stay normal. |
| Enable privacy mode Lightbox > YouTube | On | Videos load from youtube-nocookie.com, YouTube’s privacy-enhanced mode. |
| Embed with Lightbox > PDF | Object tag (default) or iFrame tag | Avoid Google Docs Viewer: the PDF goes through an external service with bandwidth and file size limits, as the plugin itself warns. |
| Disable Core Lightbox Lightbox > Global settings > Miscellaneous | On (default) | Keeps the WordPress lightbox and the plugin’s lightbox from both opening on the same image. |
| Include metadata script Same section | Off (default) | This jQuery Metadata script was at the heart of CVE-2025-3597; you don’t need it unless you pass settings through link classes. |
| Load scripts in head Same section | Off (default) | The plugin itself advises against it for load times: scripts stay in the footer. |
| Exclude Same section | The default list, plus your own selectors | File download buttons and share buttons stay normal links; add the nolightbox class to other exceptions. |
- Open a post with a gallery: images should open large, browse with the keyboard arrow keys and close with the Esc key.
- Test a PDF and a YouTube video on a phone: the window should fit the screen.
- Measure a page without images before and after activation: jQuery and FancyBox load there too, something to watch in your Core Web Vitals.
Firelight Lightbox security: XSS through contributor accounts
Patchstack lists eight patched vulnerabilities in the plugin, all of them XSS flaws. The most common scenario: a contributor account slips a booby-trapped link or image into a post, and the script runs when someone views the page or opens the lightbox.
- CVE-2026-118438, fixed in 2.3.24: an image’s
srcattribute was not properly escaped. - CVE-2026-118165, fixed in 2.3.23: the link URL was inserted without escaping in the Classic lightbox.
- CVE-2026-6454, versions up to 2.3.20: XSS in FancyBox V2’s PDF handling.
- CVE-2025-3597, fixed in 2.3.15: JavaScript execution when the jQuery Metadata script is enabled.
- CVE-2024-5020, versions up to 2.3.3: a flaw in the FancyBox library itself, shared with other plugins.
Turn on auto-updates for Firelight Lightbox (see our guide to plugin auto-updates) and only give the contributor role to people you trust, as our article on WordPress roles and capabilities explains. WP Masquerade Pro renames the easy-fancybox folder in file URLs and the handles of its scripts and styles, which makes it harder for bots to spot without replacing the update; the JavaScript variables easy_fancybox_handler and fb_IMG_select remain visible.
What WP Masquerade hides for Firelight Lightbox (Easy FancyBox)
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Firelight Lightbox (Easy FancyBox): without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- JavaScript variables
easy_fancybox_handler, fb_IMG_select
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Firelight Lightbox FAQ
Are Easy FancyBox and Firelight Lightbox the same plugin?
Yes. Easy FancyBox was renamed Firelight Lightbox in version 2.3.0, keeping the same WordPress.org address and the same folder: updating is all it takes.
How much does Firelight Pro cost?
The pricing page lists the Lite plan at $39 for one site ($49 for 5, $99 for 25), Pro+ at $59 for one site ($69 for 5, $129 for 25) and Enterprise at $199 for unlimited sites, with a 7-day free trial. It doesn’t state the billing period, but mentions a one-time payment option. Only Pro+ and Enterprise include the Pro Lightbox.
How do I stop an image from opening in the lightbox?
Add the nolightbox class to the link. To exclude a whole family of links, add its CSS selector to the Exclude setting.
Is Firelight Lightbox GDPR-compliant?
According to the developer, the free version collects no data and sets no cookies. YouTube, Vimeo or Dailymotion videos and Google Docs Viewer do load third-party services, though: turn on YouTube privacy mode and cover that content in your consent banner.