Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

12 records

Vendor: colorlibplugins Clear all filters
TI-2025-03225 CVE-2025-3662 · GHSA-3q79-wmhj-39pr

FancyBox for WordPress < 3.3.6 - Unauthenticated Stored XSS

Priority MEDIUM 60

The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00259 Published 2025-06-03 Fixed in 3.3.6 CWE-79
TI-2024-12464 CVE-2024-13423 · GHSA-33qc-76rw-rxcm

Sparkling <= 2.4.9 - Missing Authorization to Unauthenticated Arbitrary Plugin Activation/Deactivation

Priority LOW 30

The Sparkling theme for WordPress is vulnerable to unauthorized plugin activation/deactivation due to a missing capability check on the 'sparkling_activate_plugin' and 'sparkling_deactivate_plugin' functions in versions…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00384 Published 2025-03-05 No fix listed CWE-862
TI-2024-04662 CVE-2024-5020 · GHSA-54pv-xj9x-h8qj

Cross-site scripting in extendthemes Colibri Page Builder

Priority LOW 29

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and o…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00433 Published 2024-12-04 No fix listed CWE-79
TI-2024-32914 CVE-2024-49321 · GHSA-wvqg-m8f5-6fpx

WordPress Simple Custom Post Order plugin <= 2.5.7 - Broken Access Control vulnerability

Priority LOW 20

Missing Authorization vulnerability in colorlibplugins Simple Custom Post Order simple-custom-post-order allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Custom Post Order…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00328 Published 2024-10-21 No fix listed CWE-862
TI-2024-00611 CVE-2024-0662 · GHSA-cv85-hcw5-w2q9

Cross-site scripting in colorlibplugins FancyBox for WordPress

Priority LOW 23

The FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions 3.0.2 to 3.3.3 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00473 Published 2024-04-09 No fix listed CWE-79
TI-2020-18879 CVE-2020-36708 · GHSA-48h4-c5mw-4h8j

Epsilon Framework Themes (Various Versions) - Function Injection

Priority CRITICAL 85

The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, P…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.65342 Published 2023-06-07 No fix listed CWE-94
TI-2022-01804 CVE-2022-1945 · GHSA-ccp8-xc34-pq86

Coming Soon and Maintenance by Colorlib < 1.0.99 - Admin+ Stored Cross Site Scripting

Priority LOW 23

The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high privilege users such as admin to perform Stored Cross-Site Scripting when unfiltered…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00591 Published 2022-06-20 Fixed in 1.0.99 CWE-79