PT-2025-23587 · WordPress · Fancybox

Marc Montpas + 1 · Published 2025-06-03 · Updated 2025-06-05 · CVE-2025-3662

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FancyBox for WordPress versions prior to 3.3.6

Description The issue is related to the FancyBox plugin for WordPress not escaping captions and titles attributes before using them to populate galleries' caption fields. This was initially detected as a stored XSS vulnerability that required authentication, but it was escalated to an unauthenticated stored XSS issue.

Recommendations For versions prior to 3.3.6, update to version 3.3.6 or later to resolve the issue. As a temporary workaround, consider disabling the use of captions and titles attributes in galleries until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-3662

Affected Products

Fancybox

References · 6

• 🔥 https://wpscan.com/vulnerability/4cda12f0-3c23-44ad-80ea-db2443ebcf82 · Exploit
• https://osv.dev/vulnerability/CVE-2025-3662 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3662 · Security Note
• https://twitter.com/dailycve/status/1930644473140183407 · Twitter Post
• https://twitter.com/CVEnew/status/1929785815648829780 · Twitter Post
• https://t.me/cvetracker/25250 · Telegram Post