CVE-2019-16524: Improper Neutralization of Input During Web Page Generation

The easy-fancybox plugin before 1.8.18 for WordPress aka Easy FancyBox is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is no inline styles output filter...

Easy Fancybox < 1.8.18 - Authenticated Stored XSS

The Easy FancyBox WordPress plugin was affected by an Authenticated Stored XSS security vulnerability...

PT-2019-14686

Name of the Vulnerable Software and Affected Versions Easy FancyBox versions prior to 1.8.18 Description The issue arises from improper encoding of arbitrarily submitted settings parameters in the Settings Menu, specifically in the inc/class-easyfancybox.php file. This leads to Stored XSS due to...

wordpress plugin FancyBox admin-head.php physical path disclosure vulnerability

No description provided by source...

FancyBox for WordPress XSS Vulnerability

FancyBox for WordPress is prone to an XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; if...

Vulnerability analysis: WordPress image plugin Fancybox-For-WordPress vulnerability to cause the batch hung it-vulnerability warning-the black bar safety net

! Fancybox For WordPress is a great WordPress picture plugin, it can make your WordPress images pop up a nice browsing interface, showing the rich pop-up layer effect. Last week security researchers found that some Wordpress blogs suffered a batch hung it, and these blogs have in common is to...

FancyBox for WordPress 3.0.0-3.0.2 - Stored Cross-Site Scripting (XSS)

The FancyBox for WordPress WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...

CVE-2015-1494

The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting XSS attacks via an mfbfw parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfwpadding parameter and...

Cross site scripting

The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting XSS attacks via an mfbfw parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfwpadding parameter and...

CVE-2015-1494

The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting XSS attacks via an mfbfw parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfwpadding parameter and...

CVE-2015-1494

The FancyBox for WordPress plugin (versions before 3.0.3 ) is vulnerable to a persistent cross-site scripting (XSS) flaw. The root cause is a failure to properly sanitize user-supplied input in the mfbfw[*] parameter during an update action to wp-admin/admin-post.php . A remote, unauthenticated a...

PT-2015-5329

Name of the Vulnerable Software and Affected Versions FancyBox for WordPress versions prior to 3.0.3 Description The issue allows remote attackers to conduct cross-site scripting XSS attacks via a mfbfw parameter in an update action to "wp-admin/admin-post.php". This has been exploited in the wil...

VulnCheck KEV: CVE-2015-1494

The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting XSS attacks via an mfbfw parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfwpadding parameter and...

CVE-2015-1494: Improper Neutralization of Input During Web Page Generation

The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting XSS attacks via an mfbfw parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfwpadding parameter and...

Wordpress plugin Fancybox-for-WordPress 3.0.2 Stored XSS Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress plugin Fancybox-for-WordPress 3.0.2 Stored XSS Exploit Author: NULLpOint7r Date: 2015-02-11 Contact me: email protected Version: 3.0.2 Download link:...

WordPress FancyBox Plugin 3.0.2 - Stored XSS

FancyBox plugin is prone to a stored XSS vulnerability that allows to steal cookies or gain privileged access to the affected site. Solution Upgrade the plugin...

WordPress Plugin Fancybox 3.0.2 - Persistent Cross-Site Scripting

WordPress Plugin Fancybox 3.0.2 - Persistent Cross-Site Scripting Exploit Title: Wordpress plugin Fancybox-for-WordPress Stored XSS Exploit Author: NULLpOint7r Date: 2015-02-11 Contact me: [email protected] Version: 3.0.2 Download link:...

FancyBox Plugin for WordPress 'mfbfw' Parameter Persistent XSS

The version of the FancyBox plugin for WordPress installed on the remote host is affected by a persistent cross-site scripting vulnerability due to a failure properly sanitize user-supplied input to the 'mfbfw' POST parameter when the 'action' parameter is set to 'update'. A remote, unauthenticat...

WordPress Plugin Fancybox 3.0.2 - Persistent Cross-Site Scripting

Exploit Title: Wordpress plugin Fancybox-for-WordPress Stored XSS Exploit Author: NULLpOint7r Date: 2015-02-11 Contact me: [email protected] Version: 3.0.2 Download link: https://downloads.wordpress.org/plugin/fancybox-for-wordpress.3.0.2.zip Home: http://www.sec4ever.com/home/ vulnerable...

Unspecified Vulnerability in WordPress Plugin FancyBox for WordPress

WordPress is a use of PHP language development blog platform, users can support PHP and MySQL database server set up their own weblog. An unspecified vulnerability exists in FancyBox for WordPress, which allows attackers to bypass security restrictions and perform unauthorized operations...