CVE-2025-3650

jQuery Colorbox <= 4.6.3 - Contributor+ Stored XSS

Low · published September 12, 2025

CVSS v3.1
3.5
EPSS
0%
Percentile
7.3
In the wild
Unconfirmed
What it is

The jQuery Colorbox WordPress plugin through 4.6.3 uses the colorbox library, which does not sanitize title attributes on links before using them, allowing users with at least the contributor role to conduct XSS attacks against administrators.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00181 · 7.3th percentile
Published
2025-09-12T06:00Z
EPSS history
Timeline
  • 12 SEP 06:00Z
    jQuery Colorbox <= 4.6.3 - Contributor+ Stored XSS
    cvelistv5