CVE-2025-3662 - Vulnerability Details - OpenCVE

The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Colorlib	Fancybox

Configuration 1 [-]

cpe:2.3:a:colorlib:fancybox:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://wpscan.com/vulnerability/4cda12f0-3c23-44ad-80ea-db2443ebcf82/

History

Thu, 05 Jun 2025 14:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Colorlib Colorlib fancybox
Weaknesses		CWE-79
CPEs		cpe:2.3:a:colorlib:fancybox::::::wordpress::*
Vendors & Products		Colorlib Colorlib fancybox

Tue, 03 Jun 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 03 Jun 2025 06:15:00 +0000

Type	Values Removed	Values Added
Description		The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS
Title		FancyBox for WordPress < 3.3.6 - Unauthenticated Stored XSS
References		https://wpscan.com/vulnerability/4cda12f0-3c23-44ad-80ea-db2443ebcf82/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2025-06-03T06:00:17.231Z

Updated: 2025-06-03T15:28:29.716Z

Reserved: 2025-04-15T19:54:17.214Z

Link: CVE-2025-3662

Vulnrichment

Updated: 2025-06-03T15:28:23.746Z

NVD

Status : Analyzed

Published: 2025-06-03T06:15:27.873

Modified: 2025-06-05T14:09:58.017

Link: CVE-2025-3662

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3662", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2025-04-15T19:54:17.214Z", "datePublished": "2025-06-03T06:00:17.231Z", "dateUpdated": "2025-06-03T15:28:29.716Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2025-06-03T06:00:17.231Z"}, "title": "FancyBox for WordPress < 3.3.6 - Unauthenticated Stored XSS", "problemTypes": [{"descriptions": [{"description": "CWE-79 Cross-Site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "FancyBox for WordPress", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "3.3.6"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS"}], "references": [{"url": "https://wpscan.com/vulnerability/4cda12f0-3c23-44ad-80ea-db2443ebcf82/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Pierre Rudloff", "type": "finder"}, {"lang": "en", "value": "Marc Montpas", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"references": [{"url": "https://wpscan.com/vulnerability/4cda12f0-3c23-44ad-80ea-db2443ebcf82/", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-06-03T15:25:05.992366Z", "id": "CVE-2025-3662", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-03T15:28:29.716Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-3662", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-03T15:25:05.992366Z"}}}], "references": [{"url": "https://wpscan.com/vulnerability/4cda12f0-3c23-44ad-80ea-db2443ebcf82/", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-03T15:28:23.746Z"}}], "cna": {"title": "FancyBox for WordPress < 3.3.6 - Unauthenticated Stored XSS", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff"}, {"lang": "en", "type": "finder", "value": "Marc Montpas"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "FancyBox for WordPress", "versions": [{"status": "affected", "version": "0", "lessThan": "3.3.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/4cda12f0-3c23-44ad-80ea-db2443ebcf82/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-79 Cross-Site Scripting (XSS)"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2025-06-03T06:00:17.231Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3662", "state": "PUBLISHED", "dateUpdated": "2025-06-03T15:28:29.716Z", "dateReserved": "2025-04-15T19:54:17.214Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2025-06-03T06:00:17.231Z", "assignerShortName": "WPScan"}, "dataVersion": "5.1"}