Appears to be a conflict with iThemes Security Pro when the “Suspicious Query Strings – Filter Suspicious Query Strings in the URL” option is enabled.
The maintainer, Hiroaki Miyashita, can correct this by patching lightbox-gallery.php to always set the lightbox_path variable to the Site URL.
To resolve this, I have removed the if statements around the code which defines this variable in the functions lightbox_gallery_print_path_header() & lightbox_gallery_print_path_footer() and have posted the patch to http://pastebin.com/uZzUtqv8.
