QwikSec

Security Database

CVE

CWE

Training

CVE-2015-1494

Published: Feb 17, 2015

Modified: Aug 6, 2024

PUBLISHED

Description

The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an mfbfw[*] parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfw[padding] parameter and exploited in the wild in February 2015.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

vdb-entry

x_refsource_BID

[oss-security] 20150205 Re: CVE request for Zero-day in the Fancybox-for-WordPress Plugin

mailing-list

x_refsource_MLIST

https://plugins.trac.wordpress.org/changeset/1082625/

x_refsource_CONFIRM

exploit

x_refsource_EXPLOIT-DB

https://wordpress.org/plugins/fancybox-for-wordpress/changelog/

x_refsource_CONFIRM

https://wordpress.org/support/topic/possible-malware-2

x_refsource_MISC

vdb-entry

x_refsource_OSVDB

http://blog.sucuri.net/2015/02/zero-day-in-the-fancybox-for-wordpress-plugin.html

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.