CVE-2019-16524
Medium
Description
The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is no inline styles output filter.
SeverityMedium
CVSS4.8
Exploit probability—
ProductStatus301 Easy Fancybox
PublishedSep 26, 2019
First seenSep 26, 2019
How to fix
Update
- status301 easy_fancybox1.8.18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| status301 easy_fancybox | v < 1.8.18 | 1.8.18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.