Description
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
extendthemes Colibri Page Builder
Default version status: unaffected
0 to ≤ 1.0.286affected
smub Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
Default version status: unaffected
0 to ≤ 1.8.15affected
bqworks Accordion Slider
Default version status: unaffected
0 to ≤ 1.9.12affected
10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Default version status: unaffected
0 to ≤ 1.15.27affected
jetmonsters Getwid – Gutenberg Blocks
Default version status: unaffected
0 to ≤ 2.0.11affected
firelightwp Firelight Lightbox
Default version status: unaffected
0 to ≤ 2.3.3affected
dfactory Responsive Lightbox & Gallery
Default version status: unaffected
0 to ≤ 2.4.8affected
shapedplugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel
Default version status: unaffected
0 to ≤ 2.6.8affected
colorlibplugins FancyBox for WordPress
Default version status: unaffected
0 to ≤ 3.3.4affected
nko Visual Portfolio, Photo Gallery & Post Grid
Default version status: unaffected
0 to ≤ 3.3.9affected
smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Default version status: unaffected
0 to ≤ 3.59.4affected
wpclever WPC Smart Quick View for WooCommerce
Default version status: unaffected
0 to ≤ 4.1.1affected
posimyththemes Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder
Default version status: unaffected
0 to ≤ 4.3.1affected
Easy Social Feed Easy Social Feed Premium
Default version status: unaffected
0 to ≤ 6.6.2affected
foliovision FV Flowplayer Video Player
Default version status: unaffected
0 to ≤ 7.5.47.7212affected
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d99d4b9a-aa09-434d-91a8-7afaa0e8b5db?source=cve ↗
- https://plugins.trac.wordpress.org/changeset/3150376/woo-smart-quick-view ↗
- https://plugins.trac.wordpress.org/changeset/3153081/colibri-page-builder ↗
- https://plugins.trac.wordpress.org/changeset/3157076/nextgen-gallery ↗
- https://plugins.trac.wordpress.org/changeset/3158415/envira-gallery-lite ↗
- https://plugins.trac.wordpress.org/changeset/3156791/form-maker ↗
- https://plugins.trac.wordpress.org/changeset/3160432/visual-portfolio ↗
- https://plugins.trac.wordpress.org/changeset/3161422/fv-wordpress-flowplayer ↗
- https://plugins.trac.wordpress.org/changeset/3160232/easy-fancybox ↗
- https://plugins.trac.wordpress.org/changeset/3161892/wp-carousel-free ↗
- https://plugins.trac.wordpress.org/changeset/3173097/responsive-lightbox ↗
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3175577%40getwid%2Ftrunk&old=3119180%40getwid%2Ftrunk&sfp_email=&sfph_mail= ↗
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3186301%40fancybox-for-wordpress%2Ftrunk&old=3058912%40fancybox-for-wordpress%2Ftrunk&sfp_email=&sfph_mail= ↗
- https://plugins.trac.wordpress.org/changeset/3169926/accordion-slider ↗
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3306189%40the-plus-addons-for-block-editor&new=3306189%40the-plus-addons-for-block-editor&sfp_email=&sfph_mail= ↗