Easy Facebook Likebox Premium Vulnerabilities

[en] Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

Affected:

up to 6.6.2

Fix:

No patched version reported

Disclosed:

Dec 4, 2024

CVE-2024-5020 on NVD →

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVSS:

6.4

Affected:

up to 6.6.2

Fix:

No patched version reported

Disclosed:

Dec 3, 2024

CVE-2024-5020 on NVD →

[en] The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues

Affected:

up to 6.2.7

Fixed in:

6.2.7

Disclosed:

Apr 18, 2022

CVE-2021-25120 on NVD →

The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues

CVSS:

6.1

Affected:

up to 6.2.6

Fixed in:

6.2.7

Disclosed:

Apr 11, 2022

CVE-2021-25120 on NVD →