CVE Database /
CVE-2019-16524
CVE · Medium
CVE-2019-16524 — Firelight Lightbox [easy-fancybox] < 1.8.18
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2019-16524
|
Firelight Lightbox [easy-fancybox] < 1.8.18 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
4.8
|
< 1.8.18
|
1.8.18 |
2019-09-25 |
—
|
CVE-2019-16524
The easy-fancybox plugin for WordPress versions prior to 1.8.18 contains a stored cross-site scripting vulnerability in its settings menu. The vulnerability stems from inadequate encoding of user-supplied settings parameters in the inc/class-easyfancybox.php file, specifically because inline styles lack proper output filtering. An attacker could exploit this flaw to inject malicious scripts through the settings interface that would be persistently stored and executed.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings