Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: colorlibplugins Component: Fancybox Clear all filters
TI-2025-03225 CVE-2025-3662 · GHSA-3q79-wmhj-39pr

FancyBox for WordPress < 3.3.6 - Unauthenticated Stored XSS

Priority MEDIUM 60

The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00259 Published 2025-06-03 Fixed in 3.3.6 CWE-79
TI-2024-00611 CVE-2024-0662 · GHSA-cv85-hcw5-w2q9

Cross-site scripting in colorlibplugins FancyBox for WordPress

Priority LOW 23

The FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions 3.0.2 to 3.3.3 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00473 Published 2024-04-09 No fix listed CWE-79