FancyBox for WordPress Unauthenticated Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the FancyBox for WordPress plugin, affecting versions prior to 3.3.6. The issue arises because the plugin fails to properly escape caption and title attributes before using them to fill gallery caption fields. This oversight allows for the injection of malicious scripts, which can be executed when the gallery is viewed. Initially reported as a Contributor+ stored XSS, this vulnerability has been escalated to an unauthenticated stored XSS.

Impact

Exploitation of this vulnerability allows for unauthenticated stored cross-site scripting, where injected scripts are executed in the context of the user viewing the gallery.