WordPress CVEs

Description

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected WordPress components

• Accordion Slider Plugin · accordion-slider
  Confirmed match Active
  Up to and including 1.9.12
  View on WordPress.org
• Colibri Page Builder Plugin · colibri-page-builder
  Confirmed match Active
  Up to and including 1.0.286
  View on WordPress.org
• Firelight Lightbox Plugin · easy-fancybox
  Confirmed match Active
  Up to and including 2.3.3
  View on WordPress.org
• Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More Plugin · envira-gallery-lite
  Confirmed match Active
  Up to and including 1.8.15
  View on WordPress.org
• FancyBox for WordPress Plugin · fancybox-for-wordpress
  Confirmed match Active
  Up to and including 3.3.4
  View on WordPress.org
• Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Plugin · form-maker
  Confirmed match Active
  Up to and including 1.15.27
  View on WordPress.org
• FV Flowplayer Video Player Plugin · fv-wordpress-flowplayer
  Confirmed match Active
  Up to and including 7.5.47.7212
  View on WordPress.org
• Getwid – Gutenberg Blocks Plugin · getwid
  Confirmed match Active
  Up to and including 2.0.11
  View on WordPress.org
• Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery Plugin · nextgen-gallery
  Confirmed match Active
  Up to and including 3.59.4
  View on WordPress.org
• Responsive Lightbox & Gallery Plugin · responsive-lightbox
  Confirmed match Active
  Up to and including 2.4.8
  View on WordPress.org
• Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder Plugin · the-plus-addons-for-block-editor
  Confirmed match Active
  Up to and including 4.3.1
  View on WordPress.org
• Gallery by Visual Portfolio Plugin · visual-portfolio
  Confirmed match Active
  Up to and including 3.3.9
  View on WordPress.org
• WPC Smart Quick View for WooCommerce Plugin · woo-smart-quick-view
  Confirmed match Active
  Up to and including 4.1.1
  View on WordPress.org
• Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel Plugin · wp-carousel-free
  Confirmed match Active
  Up to and including 2.6.8
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• extendthemes Colibri Page Builder — Up to and including 1.0.286
• smub Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More — Up to and including 1.8.15
• bqworks Accordion Slider — Up to and including 1.9.12
• 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder — Up to and including 1.15.27
• jetmonsters Getwid – Gutenberg Blocks — Up to and including 2.0.11
• firelightwp Firelight Lightbox — Up to and including 2.3.3
• dfactory Responsive Lightbox & Gallery — Up to and including 2.4.8
• shapedplugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel — Up to and including 2.6.8
• colorlibplugins FancyBox for WordPress — Up to and including 3.3.4
• nko Visual Portfolio, Photo Gallery & Post Grid — Up to and including 3.3.9
• smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery — Up to and including 3.59.4
• wpclever WPC Smart Quick View for WooCommerce — Up to and including 4.1.1
• posimyththemes Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder — Up to and including 4.3.1
• Easy Social Feed Easy Social Feed Premium — Up to and including 6.6.2
• foliovision FV Flowplayer Video Player — Up to and including 7.5.47.7212

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3150376/woo-smart-quick-view
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3153081/colibri-page-builder
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3156791/form-maker
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3157076/nextgen-gallery
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3158415/envira-gallery-lite
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3160232/easy-fancybox
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3160432/visual-portfolio
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3161422/fv-wordpress-flowplayer
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3161892/wp-carousel-free
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3169926/accordion-slider
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3173097/responsive-lightbox
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3175577%40getwid%2Ftrunk&old=3119180%40getwid%2Ftrunk&sfp_email=&sfph_mail=
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3186301%40fancybox-for-wordpress%2Ftrunk&old=3058912%40fancybox-for-wordpress%2Ftrunk&sfp_email=&sfph_mail=
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3306189%40the-plus-addons-for-block-editor&new=3306189%40the-plus-addons-for-block-editor&sfp_email=&sfph_mail=
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/d99d4b9a-aa09-434d-91a8-7afaa0e8b5db?source=cve
• nvd.nist.gov Official NVD record