plugin
6 known security issues reported for the Wp Colorbox WordPress plugin. Most recent disclosed Aug 20, 2025.
Running Wp Colorbox on your site? Check whether your installed version is affected.
Scan your site freeThe Colorbox Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in page...
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Colorbox Lightbox allows Stored XSS. This issue affects Colorbox Lightbox: from n/a through 1.1.5.
Authenticated Stored Cross-Site Scripting (XSS) vulnerability found by Melbin K Mathew in WordPress Colorbox Lightbox plugin (versions <= 1.1.2).
The Colorbox Lightbox Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_locale’ parameter in versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers low permission levels to inject arbitrary web script...
The Colorbox Lightbox Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_locale’ parameter in versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers low permission levels to inject arbitrary web script...
The ‘hyperlink’ field in used while linking an image from a URL was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a users loads a page where the plugin shortcode is used.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free