CVE-2024-5020
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Score
- CVSS 3.1 6.4 Medium
- Status
- Deferred - security@wordfence.com
- Published
- 2024-12-04
- Last modified
- 2026-04-08
- Weaknesses
- CWE-79
Affected products
- Form Maker By 10web Mobile-friendly Drag Drop Contact Form Builder (10web)
- Accordion Slider (Bqworks)
- Fancybox For Wordpress (Colorlibplugins)
- Responsive Lightbox Gallery (Dfactory)
- Easy Social Feed Premium (Easy Social Feed)
- Colibri Page Builder (Extendthemes)
- Firelight Lightbox (Firelightwp)
- Fv Flowplayer Video Player (Foliovision)
- Getwid Gutenberg Blocks (Jetmonsters)
- Photo Gallery Post Grid (Nko)
- Visual Portfolio (Nko)
- Nexter Blocks Gutenberg Blocks (Posimyththemes)
- Page Builder Ai Website Builder (Posimyththemes)
- By Wp Carousel (Shapedplugin)
- Carousel (Shapedplugin)
- Photo Gallery With Lightbox (Shapedplugin)
- Slider (Shapedplugin)
- Video Slider (Shapedplugin)
- Albums (Smub)
- Envira Gallery Image Photo Gallery (Smub)
- Photo Gallery (Smub)
- Proofing And Themes Nextgen Gallery (Smub)
- Sliders (Smub)
- Slideshows More (Smub)
- Video Gallery (Smub)
- Wpc Smart Quick View For Woocommerce (Wpclever)
References
- https://plugins.trac.wordpress.org/changeset/3150376/woo-smart-quick-view
- https://plugins.trac.wordpress.org/changeset/3153081/colibri-page-builder
- https://plugins.trac.wordpress.org/changeset/3156791/form-maker
- https://plugins.trac.wordpress.org/changeset/3157076/nextgen-gallery
- https://plugins.trac.wordpress.org/changeset/3158415/envira-gallery-lite
- https://plugins.trac.wordpress.org/changeset/3160232/easy-fancybox
- https://plugins.trac.wordpress.org/changeset/3160432/visual-portfolio
- https://plugins.trac.wordpress.org/changeset/3161422/fv-wordpress-flowplayer
- https://plugins.trac.wordpress.org/changeset/3161892/wp-carousel-free
- https://plugins.trac.wordpress.org/changeset/3169926/accordion-slider
- https://plugins.trac.wordpress.org/changeset/3173097/responsive-lightbox
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3175577%40getwid%2Ftrunk&old=3119180%4…
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3186301%40fancybox-for-wordpress%2Ftru…
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3306189%40the-plus-addons-for-block-ed…
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d99d4b9a-aa09-434d-91a8-7afaa0e8b5db?source=cve
