CVE-2015-1494

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

6.41%

Published

Feb 17, 2015

Modified

May 6, 2026

Public PoC / Exploit (2)

All weaponized →

TrickestTrickest PoC index Exploit-DBWordPress Plugin Fancybox 3.0.2 - Persistent Cross-Site Scripting

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an mfbfw[*] parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfw[padding] parameter and exploited in the wild in February 2015.

Weaknesses (CWE)

CWE-79

Affected Products (1)

colorlib · fancyboxvulnerable

References (16)

http://blog.sucuri.net/2015/02/zero-day-in-the-fancybox-for-wordpress-plugin.html

Third Party Advisory

http://osvdb.org/show/osvdb/118543

Broken Link

http://www.exploit-db.com/exploits/36087

ExploitThird Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2015/02/05/10