Extension WordPress
Vulnérabilités FancyBox for WordPress
Cette page rassemble les failles publiées pour FancyBox for WordPress, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de FancyBox for WordPress
4 fiches
FancyBox for WordPress <= 3.3.5 – Unauthenticated Stored Cross-Site Scripting
The FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image title attributes parameter in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible…
*-3.3.5
3.3.6
13/05/2025
Multiple Plugins <= (Various Versions) – Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes…
*-3.3.4
3.3.5
03/12/2024
FancyBox for WordPress 3.0.2 – 3.3.3 – Authenticated (Admin+) Stored Cross-Site Scripting
The FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions 3.0.2 to 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level…
3.0.2-3.3.3
3.3.4
05/04/2024
FancyBox for WordPress <= 3.0.2 – Stored Cross-Site Scripting
The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an mfbfw[*] parameter in an update action to wp-admin/admin-post.php, as demonstrated by the…
[*, 3.0.3)
3.0.3
04/02/2015
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.