Vulnerability Bulletins |
CVE-2025-3662 |
|
| Affected software | WORDPRESS |
| The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2025-3662 | |