CVE-2019-16524

The CVE describes a Stored XSS in the WordPress Easy FancyBox plugin prior to version 1.8.18. Affected component: the plugin’s Settings Menu (inc/class-easyfancybox.php). Root cause: improper encoding of arbitrarily submitted settings parameters and absence of an inline styles output filter, enab...