Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Colibri Page Builder
Vendor
extendthemes
Product
Colibri Page Builder
Platforms
Unknown
Default status
unaffected
Colibri Page Builder · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
1.0.286
None listed
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
Vendor
smub
Product
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
Platforms
Unknown
Default status
unaffected
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
1.8.15
None listed
Accordion Slider
Vendor
bqworks
Product
Accordion Slider
Platforms
Unknown
Default status
unaffected
Accordion Slider · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
1.9.12
None listed
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Vendor
10web
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Platforms
Unknown
Default status
unaffected
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
1.15.27
None listed
Getwid – Gutenberg Blocks
Vendor
jetmonsters
Product
Getwid – Gutenberg Blocks
Platforms
Unknown
Default status
unaffected
Getwid – Gutenberg Blocks · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
2.0.11
None listed
Firelight Lightbox
Vendor
firelightwp
Product
Firelight Lightbox
Platforms
Unknown
Default status
unaffected
Firelight Lightbox · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
2.3.3
None listed
Responsive Lightbox & Gallery
Vendor
dfactory
Product
Responsive Lightbox & Gallery
Platforms
Unknown
Default status
unaffected
Responsive Lightbox & Gallery · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
2.4.8
None listed
Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel
Vendor
shapedplugin
Product
Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel
Platforms
Unknown
Default status
unaffected
Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
2.6.8
None listed
FancyBox for WordPress
Vendor
colorlibplugins
Product
FancyBox for WordPress
Platforms
Unknown
Default status
unaffected
FancyBox for WordPress · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
3.3.4
None listed
Visual Portfolio, Photo Gallery & Post Grid
Vendor
nko
Product
Visual Portfolio, Photo Gallery & Post Grid
Platforms
Unknown
Default status
unaffected
Visual Portfolio, Photo Gallery & Post Grid · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
3.3.9
None listed
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Vendor
smub
Product
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Platforms
Unknown
Default status
unaffected
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
3.59.4
None listed
WPC Smart Quick View for WooCommerce
Vendor
wpclever
Product
WPC Smart Quick View for WooCommerce
Platforms
Unknown
Default status
unaffected
WPC Smart Quick View for WooCommerce · Scoped product and version facts