← Database

CVE-2025-3662

MEDIUM CVSS: 6.1 Published: 2025-06-03 Modified: 2026-06-17

Description

The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS

Affected Platforms

Colorlib Fancybox

Weakness Type

CWE-79

References