{"id":"CVE-2024-5020","aliases":["EUVD-2024-47141","GHSA-54pv-xj9x-h8qj"],"status":"published","title":"Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library","description":"Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00433,"percentile":0.3786,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-12-04T08:22:46Z","modified":"2026-06-17T08:14:55Z","products":[{"vendor":"10web","product":"form maker by 10web – mobile-friendly drag \u0026 drop contact form builder"},{"vendor":"bqworks","product":"accordion slider"},{"vendor":"colorlibplugins","product":"fancybox for wordpress"},{"vendor":"dfactory","product":"responsive lightbox \u0026 gallery"},{"vendor":"easy social feed","product":"easy social feed premium"},{"vendor":"extend themes","product":"colibri page builder"},{"vendor":"extendthemes","product":"colibri page builder"},{"vendor":"firelightwp","product":"firelight lightbox"},{"vendor":"foliovision","product":"fv flowplayer video player"},{"vendor":"fv flowplayer video player","product":"fv flowplayer video player"},{"vendor":"jetmonsters","product":"getwid – gutenberg blocks"},{"vendor":"nk","product":"visual portfolio, photo gallery \u0026 post grid"},{"vendor":"nko","product":"visual portfolio, photo gallery \u0026 post grid"},{"vendor":"posimyththemes","product":"nexter blocks – gutenberg blocks, page builder \u0026 ai website builder"},{"vendor":"shapedplugin","product":"carousel, slider, photo gallery with lightbox, video slider, by wp carousel"},{"vendor":"smub","product":"envira gallery – image photo gallery, albums, video gallery, slideshows \u0026 more"},{"vendor":"smub","product":"photo gallery, sliders, proofing and themes – nextgen gallery"},{"vendor":"unknown","product":"fancybox for wordpress"},{"vendor":"unknown","product":"responsive lightbox \u0026 gallery"},{"vendor":"wpclever","product":"wpc smart quick view for woocommerce"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d99d4b9a-aa09-434d-91a8-7afaa0e8b5db?source=cve"},{"url":"https://plugins.trac.wordpress.org/changeset/3150376/woo-smart-quick-view"},{"url":"https://plugins.trac.wordpress.org/changeset/3153081/colibri-page-builder"},{"url":"https://plugins.trac.wordpress.org/changeset/3157076/nextgen-gallery"},{"url":"https://plugins.trac.wordpress.org/changeset/3158415/envira-gallery-lite"},{"url":"https://plugins.trac.wordpress.org/changeset/3156791/form-maker"},{"url":"https://plugins.trac.wordpress.org/changeset/3160432/visual-portfolio"},{"url":"https://plugins.trac.wordpress.org/changeset/3161422/fv-wordpress-flowplayer"},{"url":"https://plugins.trac.wordpress.org/changeset/3160232/easy-fancybox"},{"url":"https://plugins.trac.wordpress.org/changeset/3161892/wp-carousel-free"},{"url":"https://plugins.trac.wordpress.org/changeset/3173097/responsive-lightbox"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3175577%40getwid%2Ftrunk\u0026old=3119180%40getwid%2Ftrunk\u0026sfp_email=\u0026sfph_mail="},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3186301%40fancybox-for-wordpress%2Ftrunk\u0026old=3058912%40fancybox-for-wordpress%2Ftrunk\u0026sfp_email=\u0026sfph_mail="},{"url":"https://plugins.trac.wordpress.org/changeset/3169926/accordion-slider"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3306189%40the-plus-addons-for-block-editor\u0026new=3306189%40the-plus-addons-for-block-editor\u0026sfp_email=\u0026sfph_mail="},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5020"},{"url":"https://github.com/advisories/GHSA-54pv-xj9x-h8qj"}],"sources":{"cve":[{"id":"CVE-2024-5020","title":"Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library","description":"Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2024-12-04T08:22:46.855Z","modified":"2026-04-08T17:27:10.759Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:01.286506Z"}],"euvd":[{"id":"EUVD-2024-47141","description":"Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2024-12-04T08:22:46Z","modified":"2026-04-08T17:27:10Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:37.761544Z"}],"ghsa":[{"id":"GHSA-54pv-xj9x-h8qj","title":"Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's...","description":"Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2024-12-04T12:31:45Z","modified":"2026-04-08T21:34:02Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:07:22.142665Z"}],"nvd":[{"id":"CVE-2024-5020","description":"Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2024-12-04T09:15:04.813Z","modified":"2026-06-17T08:14:55.237Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:38.973941Z"}]}}