FancyBox for WordPress

FancyBox for WordPress has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2025; all 4 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2024 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (100%).

Every one of the 4 issues recorded for FancyBox for WordPress has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. FancyBox for WordPress is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
6.0/ 10
Patch Coverage100%
Open

0

Fixed

4

Get automatic notifications for all FancyBox for WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2025-3662

FancyBox for WordPress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

4 records
FancyBox for WordPress banner
Latestv3.4.2

FancyBox for WordPress

colorlibplugins

Author

colorlibplugins

4.6(92)
92/100
Last Updated
2026-08-07 (1mo ago)
Active Installs
30,000+
Downloads
1,974,998
Requires WP
5.6+
Requires PHP
7.4+
Tested up to
WP 7.0.4
Created
2009-02-06 (18y ago)

FancyBox for WordPress turns the images you already have into a lightbox gallery. Activate it and every image that links to a full-size file opens in an overlay instead of loading a new page — in posts, pages, widgets and the block editor’s gallery blocks, with no shortcodes and nothing to add to your content. If the defaults suit you, there is nothing to configure. What you get out of the box Click any linked image to open it in an overlay, with the rest of the page dimmed behind it Arrow keys, on-screen arrows, swipe on touch devices, and Escape to close Zoom, slideshow, thumbnail strip and full-screen controls in the toolbar Captions taken from the image title, the block editor’s caption, or a data-caption attribute Galleries grouped automatically — everything on the page, per post, or per gallery block PDFs, videos and other pages open in the lightbox too What you can change Settings live under Settings → Fancybox for WP, split into Appearance, Animations, Behaviour, Galleries and Misc: Overlay colour and opacity, padding, border, background colour Caption position (inside the frame, over the image, or below it), size and colour Opening and transition animations, and their speed Close on overlay click, close on image click, zoom on click, mouse-wheel navigation, looping Turn the lightbox off on mobile, on WooCommerce shop pages, or on product pages Exclude PDF links, or exclude individual images with class="nolightbox" A custom jQuery expression if you want to decide exactly which links are affected Built on FancyBox 3 The plugin bundles FancyBox 3.5.7. Nothing is loaded from an external CDN, so no visitor data leaves your site. The bundled copy is namespaced (fancyboxforwp) so it will not collide with a FancyBox that your theme or another plugin already loads. Translations Available in your language through WordPress.org language packs. Translations are contributed by the community at translate.wordpress.org — help for your locale is very welcome. Contributing Development happens on GitHub. Bug reports and pull requests are welcome. This plugin is developed and maintained by Colorlib, who also make free WordPress themes. If it is useful to you, a review genuinely helps.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C