WordPress Getwid – Gutenberg Blocks plugin <= 2.0.11 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library

🗓️ 03 Dec 2024 23:52:16Reported by WebbernautType

Authenticated contributors can trigger a stored DOM-based cross-site scripting in Getwid up to 2.0.11 via FancyBox.

Reporter	Title	Published	Views	Family All 25
Circl	CVE-2024-5020	4 Dec 202408:50	–	circl
CNNVD	WordPress plugin多款产品跨站脚本漏洞	4 Dec 202400:00	–	cnnvd
CVE	CVE-2024-5020	4 Dec 202408:22	–	cve
Cvelist	CVE-2024-5020 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library	4 Dec 202408:22	–	cvelist
EUVD	EUVD-2024-47141	3 Oct 202520:07	–	euvd
NVD	CVE-2024-5020	4 Dec 202409:15	–	nvd
Patchstack	WordPress Colibri Page Builder plugin <= 1.0.286 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library	3 Dec 202423:52	–	patchstack
Patchstack	WordPress Firelight Lightbox plugin <= 2.3.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library	3 Dec 202423:52	–	patchstack
Patchstack	WordPress NextGEN Gallery plugin <= 3.59.4 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library	3 Dec 202423:52	–	patchstack
Patchstack	WordPress Thumbnail Slider With Lightbox plugin <= 1.0.21 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting vulnerability	12 Nov 202505:13	–	patchstack

Vulners

Node

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/detail/multiple-plugins-various-versions-authenticated-contributor-stored-dom-based-cross-site-scripting-via-fancybox-javascript-library

03 Dec 2024 23:52Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.16.4

EPSS0.006

SSVC