Unknown Fancybox For Wordpress vulnerabilities

1 vulnerability

Known vulnerabilities in Unknown Fancybox For Wordpress, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.2CVE-2025-3662colorlibfancybox+2
EPSS score
0.25%
The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS