CVE-2015-1494

The FancyBox for WordPress plugin (versions before 3.0.3 ) is vulnerable to a persistent cross-site scripting (XSS) flaw. The root cause is a failure to properly sanitize user-supplied input in the mfbfw[*] parameter during an update action to wp-admin/admin-post.php . A remote, unauthenticated a...

WordPress FancyBox Plugin Code Injection (CVE-2015-1494)

A code injection vulnerability has been reported in WordPress FancyBox Plugin. A remote attacker could inject arbitrary code into the FancyBox Plugin code via crafted parameters...