CVE-2015-1494

The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting…

published February 17, 2015

CVSS
—
EPSS
6%
Percentile
93.7
In the wild
Unconfirmed
What it is

The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an mfbfw[*] parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfw[padding] parameter and exploited in the wild in February 2015.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06407 · 93.7th percentile
Published
2015-02-17T15:00Z
EPSS history
Timeline
  • 17 FEB 15:00Z
    The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting…
    cvelistv5