6.4
Medium
CVE-2024-5020 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox…
Description
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Colibri Page Builder 1.0 | earliest → 1.0.286 | No fix stated |
| Gallery Plugin for WordPress – Envira Photo Gallery 1.8 | earliest → 1.8.15 | No fix stated |
| Accordion Slider 1.9 | earliest → 1.9.12 | No fix stated |
| Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder 1.15 | earliest → 1.15.27 | No fix stated |
| Getwid – Gutenberg Blocks 2.0 | earliest → 2.0.11 | No fix stated |
| Firelight Lightbox 2.3 | earliest → 2.3.3 | No fix stated |
| Responsive Lightbox & Gallery 2.4 | earliest → 2.4.8 | No fix stated |
| Carousel, Slider, Gallery by WP Carousel – Image Carousel with Lightbox & Photo Gallery, Video Slider, Post Carousel & Post Grid, Product Carousel & Product Grid 2.6 | earliest → 2.6.8 | No fix stated |
| FancyBox for WordPress 3.3 | earliest → 3.3.4 | No fix stated |
Show the 8 other branches Hide the 8 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Visual Portfolio, Photo Gallery & Post Grid 3.3 | earliest → 3.3.9 | No fix stated |
| Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery 3.59 | earliest → 3.59.4 | No fix stated |
| WPC Smart Quick View for WooCommerce 4.1 | earliest → 4.1.1 | No fix stated |
| Easy Social Feed Premium 6.6 | earliest → 6.6.2 | No fix stated |
| FV Flowplayer Video Player 7.5 | earliest → 7.5.47.7212 | No fix stated |
| Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More 1.8 | earliest → 1.8.15 | No fix stated |
| Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel 2.6 | earliest → 2.6.8 | No fix stated |
| Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder 4.3 | earliest → 4.3.1 | No fix stated |
Other CVEs of Colibri Page Builder
The 18 CVEs of Colibri Page Builder →
CVE-2026-107758
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter…
7.2
High
CVE-2025-11747
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the colibri_blog_posts…
6.4
Medium
CVE-2025-11376
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's…
6.4
Medium
CVE-2025-9560
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's…
6.4
Medium