Fancybox For Wordpress Vulnerabilities

The FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image title attributes parameter in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts i...

CVSS:

7.2

Affected:

up to 3.3.5

Fixed in:

3.3.6

Disclosed:

May 13, 2025

CVE-2025-3662 on NVD →

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVSS:

6.4

Affected:

up to 3.3.4

Fixed in:

3.3.5

Disclosed:

Dec 3, 2024

CVE-2024-5020 on NVD →

The FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions 3.0.2 to 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary w...

CVSS:

4.4

Affected:

3.0.2 – 3.3.3

Fixed in:

3.3.4

Disclosed:

Apr 5, 2024

CVE-2024-0662 on NVD →

The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an mfbfw[*] parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfw[padding] parameter and exploited in the wild...

CVSS:

6.1

Affected:

up to 3.0.3

Fixed in:

3.0.3

Disclosed:

Feb 4, 2015

CVE-2015-1494 on NVD →