Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Details
- CVSS 3.1 Base Score: 6.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Accordion Slider Plugin | accordion-slider-plugin-cve-2024-5020 | May 15, 2025 | Dec 3, 2024 | |
| Colibri Page Builder Plugin | colibri-page-builder-plugin-cve-2024-5020 | May 15, 2025 | Dec 3, 2024 | |
| Easy Fancybox Plugin | easy-fancybox-plugin-cve-2024-5020 | May 15, 2025 | Dec 3, 2024 | |
| Envira Gallery Lite Plugin | envira-gallery-lite-plugin-cve-2024-5020 | May 15, 2025 | Dec 3, 2024 | |
| Fancybox For Wordpress Plugin | fancybox-for-wordpress-plugin-cve-2024-5020 | May 15, 2025 | Dec 3, 2024 | |
| Form Maker Plugin | form-maker-plugin-cve-2024-5020 | May 15, 2025 | Dec 3, 2024 | |
| Fv Wordpress Flowplayer Plugin | fv-wordpress-flowplayer-plugin-cve-2024-5020 | May 15, 2025 | Dec 3, 2024 | |
| Getwid Plugin | getwid-plugin-cve-2024-5020 | May 15, 2025 | Dec 3, 2024 | |
| Nextgen Gallery Plugin | nextgen-gallery-plugin-cve-2024-5020 | May 15, 2025 | Dec 3, 2024 | |
| Responsive Lightbox Plugin | responsive-lightbox-plugin-cve-2024-5020 | May 15, 2025 | Dec 3, 2024 | |
| The Plus Addons For Block Editor Plugin | the-plus-addons-for-block-editor-plugin-cve-2024-5020 | Jun 16, 2025 | Dec 3, 2024 | |
| Visual Portfolio Plugin | visual-portfolio-plugin-cve-2024-5020 | May 15, 2025 | Dec 3, 2024 | |
| Woo Smart Quick View Plugin | woo-smart-quick-view-plugin-cve-2024-5020 | May 15, 2025 | Dec 3, 2024 | |
| Wp Carousel Free Plugin | wp-carousel-free-plugin-cve-2024-5020 | May 15, 2025 | Dec 3, 2024 | |
| Wp Responsive Slider With Lightbox Plugin | wp-responsive-slider-with-lightbox-plugin-cve-2024-5020 | Nov 12, 2025 | Nov 11, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub