Simple Colorbox
Simple Colorbox has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Simple Colorbox has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Prissy. Simple Colorbox is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.4.34.
CVE-2025-60124Simple Colorbox <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Simple Colorbox
Author
Ryan Hellyer
Adds a very simple Colorbox to your linked images. This plugin is intended as an easy to use alternative to other lightbox / Colorbox alternatives. Unlike most other plugins with similar functionality, this one does not have any settings or requirements whatsoever, simple install, activate and yer done 🙂 More information can be found on the Simple Colorbox plugin page. Credits Thanks to the following (in no particular order) for help with the development of this plugin: * Milan Dinić – Added extensive upgrade patch for increasing extensibility * Arnstein Larsen – Motivated me to add slideshow support * Utkarsh – Assistance with jQuery bug * Ronalfy – Suggested I use Colorbox
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C