CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47310 – WordPress ARI Fancy Lightbox - Popup for WordPress plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-47310
25 Sep 2024 — Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ARI Soft ARI Fancy Lightbox allows Stored XSS.This issue affects ARI Fancy Lightbox: from n/a through 1.3.17. The ARI Fancy Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbit... • https://patchstack.com/database/vulnerability/ari-fancy-lightbox/wordpress-ari-fancy-lightbox-popup-for-wordpress-plugin-1-3-17-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0161 – ARI Fancy Lightbox < 1.3.9 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-0161
17 Feb 2022 — The ARI Fancy Lightbox WordPress plugin before 1.3.9 does not sanitise and escape the msg parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting El plugin ARI Fancy Lightbox de WordPress versiones anteriores a 1.3.9, no sanea ni escapa del parámetro msg antes de devolverlo a una página de administración, conllevando a un ataque de tipo Cross-Site Scripting Reflejado • https://plugins.trac.wordpress.org/changeset/2680993 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •