Fancybox

3 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2025-3662 Jun 03, 06:15 MEDIUM POC PATCH This Month

The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS

PHP WordPress XSS Fancybox Colorlib

NVD WPScan

CVSS 3.1

6.1

EPSS

0.1%

CVE-2024-0662 Apr 09, 19:15 MEDIUM PATCH This Month

The FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions 3.0.2 to 3.3.3 due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

WordPress XSS Fancybox Wordpress Plugin Colorlib

NVD

CVSS 3.1

4.8

EPSS

0.5%

CVE-2015-1494 Feb 17, 15:59 MEDIUM POC PATCH This Month

The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an mfbfw[*] parameter. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.

PHP WordPress XSS Fancybox Wordpress Plugin +1

NVD Exploit-DB

CVSS 2.0

4.3

EPSS

4.6%

CVE-2025-3662

EPSS 0% CVSS 6.1

MEDIUM POC PATCH This Month

PHP WordPress XSS +2

NVD WPScan

CVE-2024-0662

EPSS 0% CVSS 4.8

MEDIUM PATCH This Month

WordPress XSS Fancybox +2

NVD

CVE-2015-1494

EPSS 5% CVSS 4.3

MEDIUM POC PATCH This Month

PHP WordPress XSS +3

NVD Exploit-DB