CVE-2015-1494: colorlib fancybox Cross-site Scripting
Vulnerability summary
CVE-2015-1494 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in colorlib fancybox. EPSS estimates a 6.41% chance of exploitation in the next 30 days, higher than 93.6% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 3.0.3.
Timeline
- 17-02-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an mfbfw[*] parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfw[padding] parameter and exploited in the wild in February 2015.
CVSS metrics
2 scores · 2 sources · 2 versionsEPSS trend
Probability
6.41%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 6.41% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (wordpress.org)
Maturity: unknown
WordPress Plugin Fancybox 3.0.2 - Persistent Cross-Site Scripting
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Colorlib1 product
- fancybox≤ 3.0.2
Wordpress1 product
- fancybox-for-wordpress< 3.0.3
2 vendors · 2 products
References
9 links- blog.sucuri.net/2015/02/zero-day-in-the-fancybox-for-wordpress-plugin.htmlX Refsource MISCThird Party Advisory