CVE-2024-5020

CVSS V2 None CVSS V3 None
Description
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Overview
  • CVE ID
  • CVE-2024-5020
  • Assigner
  • Wordfence
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-12-04T08:22:46.855Z
  • Last Modified Date
  • 2024-12-04T14:09:09.188Z
Weakness Enumerations
CWE URL
CWE-79 http://cwe.mitre.org/data/definitions/79.html
References
Reference URL Reference Tags
https://www.wordfence.com/threat-intel/vulnerabilities/id/d99d4b9a-aa09-434d-91a8-7afaa0e8b5db?source=cve
https://plugins.trac.wordpress.org/changeset/3150376/woo-smart-quick-view
https://plugins.trac.wordpress.org/changeset/3153081/colibri-page-builder
https://plugins.trac.wordpress.org/changeset/3157076/nextgen-gallery
https://plugins.trac.wordpress.org/changeset/3158415/envira-gallery-lite
https://plugins.trac.wordpress.org/changeset/3156791/form-maker
https://plugins.trac.wordpress.org/changeset/3160432/visual-portfolio
https://plugins.trac.wordpress.org/changeset/3161422/fv-wordpress-flowplayer
https://plugins.trac.wordpress.org/changeset/3160232/easy-fancybox
https://plugins.trac.wordpress.org/changeset/3161892/wp-carousel-free
https://plugins.trac.wordpress.org/changeset/3173097/responsive-lightbox
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3175577%40getwid%2Ftrunk&old=3119180%40getwid%2Ftrunk&sfp_email=&sfph_mail=
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3186301%40fancybox-for-wordpress%2Ftrunk&old=3058912%40fancybox-for-wordpress%2Ftrunk&sfp_email=&sfph_mail=
https://plugins.trac.wordpress.org/changeset/3169926/accordion-slider
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-5020
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5020
History
Created Old Value New Value Data Type Notes
2024-12-05 13:14:58 Added to TrackCVE