Colorlib Fancybox
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Colorlib Fancybox.
By the Year
In 2026 there have been 0 vulnerabilities in Colorlib Fancybox. Last year, in 2025 Fancybox had 1 security vulnerability published. Right now, Fancybox is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 1 | 0.00 |
| 2024 | 1 | 4.80 |
It may take a day or so for new Fancybox vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Colorlib Fancybox Security Vulnerabilities
Unauth Stored XSS in WordPress FancyBox <3.3.6 (Captions)
CVE-2025-3662
- June 03, 2025
The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS
XSS
FancyBox 3.0.23.3.3 WPStored XSS via Admin Settings
CVE-2024-0662
4.8 - Medium
- April 09, 2024
The FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions 3.0.2 to 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
XSS
The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which
CVE-2015-1494
- February 17, 2015
The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an mfbfw[*] parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfw[padding] parameter and exploited in the wild in February 2015.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Colorlib Fancybox or by Colorlib? Click the Watch button to subscribe.
