Plugin security history

FancyBox for WordPress Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 4 vulnerability records associated with FancyBox for WordPress, published between 2015 and 2025.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

4Total records

0Critical

1High

3Medium

0Low

0Informational

4Patched records

0Currently marked unpatched

2015-02-04First disclosure

2025-05-13Latest disclosure

4 of 4CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2015	1	1 records
2024	2	2 records
2025	1	1 records

Severity Breakdown

Severity	Records	Share
High	1	25%
Medium	3	75%

Vulnerability-Type Breakdown

Cross-Site Scripting

4 records100%

First: 2015. Latest: 2025.

Patch Status

Patched: 4
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.3.6
3.3.5
3.3.4
3.0.3

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.3.5`	FancyBox for WordPress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting	May 13, 2025	3.3.6	High
`*-3.3.4`	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library	December 3, 2024	3.3.5	Medium
`3.0.2-3.3.3`	FancyBox for WordPress 3.0.2 - 3.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting	April 5, 2024	3.3.4	Medium
`[*, 3.0.3)`	FancyBox for WordPress <= 3.0.2 - Stored Cross-Site Scripting	February 4, 2015	3.0.3	Medium

Selected source records

Latest Records

HighCVE-2025-3662

FancyBox for WordPress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting

Published: May 13, 2025

Affected versions: *-3.3.5
Patched versions: 3.3.6

Original Wordfence record

MediumCVE-2024-5020

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library

Published: December 3, 2024

Affected versions: *-2.4.8
Patched versions: 2.4.9

Affected versions: *-4.1.1
Patched versions: 4.1.2

Affected versions: *-1.9.12
Patched versions: 1.9.13

Affected versions: *-7.5.47.7212
Patched versions: 7.5.48.7212

Affected versions: *-1.8.15
Patched versions: 1.8.16

Affected versions: *-1.0.286
Patched versions: 1.0.288

Affected versions: *-3.3.9
Patched versions: 3.3.10

Affected versions: *-2.0.11
Patched versions: 2.0.12

Affected versions: *-2.3.3
Patched versions: 2.3.4

Affected versions: *-4.3.1
Patched versions: 4.3.2

Affected versions: *-3.3.4
Patched versions: 3.3.5

Affected versions: *-2.6.8
Patched versions: 2.6.9

Affected versions: *-1.15.27
Patched versions: 1.15.28

Affected versions: *-3.59.4
Patched versions: 3.59.5

Affected versions: *-6.6.2
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2024-0662

FancyBox for WordPress 3.0.2 - 3.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting

Published: April 5, 2024

Affected versions: 3.0.2-3.3.3
Patched versions: 3.3.4

Original Wordfence record

MediumCVE-2015-1494

FancyBox for WordPress <= 3.0.2 - Stored Cross-Site Scripting

Published: February 4, 2015

Affected versions: [*, 3.0.3)
Patched versions: 3.0.3

Original Wordfence record

Highest-Severity Records

HighCVE-2025-3662

FancyBox for WordPress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting

Published: May 13, 2025

Affected versions: *-3.3.5
Patched versions: 3.3.6

Original Wordfence record

MediumCVE-2024-5020

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library

Published: December 3, 2024

Affected versions: *-2.4.8
Patched versions: 2.4.9

Affected versions: *-4.1.1
Patched versions: 4.1.2

Affected versions: *-1.9.12
Patched versions: 1.9.13

Affected versions: *-7.5.47.7212
Patched versions: 7.5.48.7212

Affected versions: *-1.8.15
Patched versions: 1.8.16

Affected versions: *-1.0.286
Patched versions: 1.0.288

Affected versions: *-3.3.9
Patched versions: 3.3.10

Affected versions: *-2.0.11
Patched versions: 2.0.12

Affected versions: *-2.3.3
Patched versions: 2.3.4

Affected versions: *-4.3.1
Patched versions: 4.3.2

Affected versions: *-3.3.4
Patched versions: 3.3.5

Affected versions: *-2.6.8
Patched versions: 2.6.9

Affected versions: *-1.15.27
Patched versions: 1.15.28

Affected versions: *-3.59.4
Patched versions: 3.59.5

Affected versions: *-6.6.2
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2015-1494

FancyBox for WordPress <= 3.0.2 - Stored Cross-Site Scripting

Published: February 4, 2015

Affected versions: [*, 3.0.3)
Patched versions: 3.0.3

Original Wordfence record

MediumCVE-2024-0662

FancyBox for WordPress 3.0.2 - 3.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting

Published: April 5, 2024

Affected versions: 3.0.2-3.3.3
Patched versions: 3.3.4

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory