CVE-2025-3662

Description

The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS

Reserved 2025-04-15 | Published 2025-06-03 | Updated 2025-06-03 | Assigner WPScan

Problem types

CWE-79 Cross-Site Scripting (XSS)

Product status

Default status
unaffected

Any version before 3.3.6
affected

Credits

Pierre Rudloff finder

Marc Montpas finder

WPScan coordinator

References

wpscan.com/...rability/4cda12f0-3c23-44ad-80ea-db2443ebcf82/ exploit vdb-entry technical-description

cve.org (CVE-2025-3662)

nvd.nist.gov (CVE-2025-3662)

Download JSON