WordPress WP Video Lightbox plugin <= 1.9.2 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Vishnupriya Ilango Fortinet Fortiguard Labs in WordPress WP Video Lightbox plugin versions = 1.9.2. Solution Update the WordPress WP Video Lightbox plugin to the latest available version at least 1.9.3...

Gallery Blocks with Lightbox < 2.2.1- Authenticated Stored Cross-Site Scripting

A stored cross-site scripting vulnerability has been discovered in : Simply Gallery Blocks with Lightbox Version – 2.2.0 & below . The vulnerability exists in the Lightbox functionality where a user with low privileges is allowed to execute arbitrary script code within the context of the...

Wonder Video Embed < 1.8 - Contributor+ Stored XSS

The plugin does not escape parameters of its wonderpluginvideo shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks. wonderpluginvideo iframe='youtube.com?v=dQw4w9WgXcQ" onload="alert1' videocss='animation-name:twentytwentyone-close-button-transition"...

SQL Injection Vulnerability in Lightbox Cloud Platform Pro

The Lightbox Cloud Platform Pro is an intelligent cloud server management system. Ltd. Lightboat Cloud Platform Pro has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information from the database...

WordPress Plugin Colorbox Lightbox Cross-Site Scripting Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A cross-site scripting vulnerability exists in the WordPress plugin Colorbox Lightbox. An...

FooGallery < 1.9.25 - Authenticated Cross-Site Scripting (XSS)

The FooGallery WordPress plugin was found to be vulnerable to Authenticated Cross-Site Scripting XSS. "The vulnerability is caused by improper sanitization of user input in the image title or caption parameters in the gallery media upload editor. Thereby it can lead to an XSS in the default...

WordPress Fancybox Lightbox Cross-Site Scripting Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A cross-site scripting vulnerability exists in WordPress Fancybox Lightbox. An attacker can...

Colorbox Lightbox <= 1.1.2 - Authenticated Stored Cross-Site Scripting

The ‘hyperlink’ field in used while linking an image from a URL was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a users loads a page where the plugin shortcode is used. All WordPress websites using...

Fancy Lightbox < 1.0.2 - Authenticated Stored Cross-Site Scripting

The ‘hyperlink’ field in used while linking a remote resource Image, Video or web page from a URL was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a users loads a page where the plugin shortcode is used...

Colorbox Lightbox <= 1.1.2 - Authenticated Stored Cross-Site Scripting

The ‘hyperlink’ field in used while linking an image from a URL was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a users loads a page where the plugin shortcode is used. All WordPress websites using...

WordPress Colorbox Lightbox plugin <= 1.1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by Melbin K Mathew in WordPress Colorbox Lightbox plugin versions = 1.1.2. Solution Update the WordPress Colorbox Lightbox plugin to the latest available version at least 1.1.3...

Fancy Lightbox < 1.0.2 - Authenticated Stored Cross-Site Scripting

The ‘hyperlink’ field in used while linking a remote resource Image, Video or web page from a URL was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a users loads a page where the plugin shortcode is used...

Responsive Lightbox2 < 1.0.3 - Authenticated Stored Cross-Site Scripting

The ‘hyperlink’ field in used while linking an image from a URL was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a users loads a page where the plugin shortcode is used. All WordPress websites using...

WordPress Fancybox Lightbox 1.0.1 Cross Site Scripting

Exploit Title: WordPress Fancybox Lightbox Plugin v1.0.1 - Persistent Cross-Site Scripting Date: 2020-08-14 Vendor Homepage: https://noorsplugin.com/ Vendor Changelog: https://wordpress.org/plugins/wp-fancybox/developers Exploit Author: Melbin K Mathew @melbinkm Author Advisory:...

WordPress Colorbox Lightbox 1.1.2 Cross Site Scripting

Exploit Title: WordPress Colorbox Lightbox Plugin v1.1.2 - Persistent Cross-Site Scripting Date: 2020-08-14 Vendor Homepage: https://noorsplugin.com/ Vendor Changelog:https://wordpress.org/plugins/wp-colorbox/ /developers Exploit Author: Melbin K Mathew @melbinkm Author Advisory:...

WordPress Lightbox Plus Colorbox Plugin Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.Lightbox Plus Colorbox plugin is an image magnification viewing plugin used in it. A cross-site request forgery vulnerabilit...

CVE-2016-10865

The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery CSRF via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS...

CVE-2016-10865

The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery CSRF via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS...

Cross site request forgery (csrf)

The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery CSRF via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS...

CVE-2016-10865

The CVE-2016-10865 issue affects the WordPress plugin Lightbox Plus Colorbox up to version 2.7.2 . The vulnerability is a CSRF fault on the admin page (wp-admin/admin.php?page=lightboxplus) that can lead to a resulting XSS vector. Root cause: inadequate CSRF protection on that admin entry point. ...