WordPress security by component

FancyBox for

Plugin description

FancyBox for is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Jun 03, 2025; the highest CVE/CNA score is 6.1.

Plugin slug: fancybox

Latest vulnerability

CVE-2025-3662: FancyBox for: Cross-site scripting

FancyBox for is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

PublishedJun 03, 2025

Safe version guidanceSee mitigation notes

		Safe version
Jun 03, 2025	CVE-2025-3662 FancyBox for: Cross-site scripting FancyBox for is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1 NVDPending
Apr 09, 2024	CVE-2024-0662 FancyBox for: Cross-site scripting FancyBox for is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.4 NVD4.8