CVE-2025-3662

FancyBox for WordPress < 3.3.6 - Unauthenticated Stored XSS

Medium · published June 3, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
15.2
In the wild
Unconfirmed
What it is

The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00248 · 15.2th percentile
Published
2025-06-03T06:00Z
EPSS history
Timeline
  • 03 JUN 06:00Z
    FancyBox for WordPress < 3.3.6 - Unauthenticated Stored XSS
    cvelistv5