WP fancybox

WP fancybox has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2025; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 7.4, and the most serious one scores 8.3 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

2 independent researchers contributed these findings, one record each. WP fancybox is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.

Strategic Overview

Avg CVSSHigh

7.4/ 10

Patch Coverage50%

Open

Fixed

Get automatic notifications for all WP fancybox vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-26591

WP fancybox <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records


2025-07-04 00:00	WP fancybox <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting WP fancybox <= 1.0.4	`CVE-2025-26591`	6.4 Medium	Prissy	No
2020-08-14 00:00	WordPress fancybox <= 1.0.2 - Stored Cross-Site Scripting WP fancybox <= 1.0.2	`N/A`	8.3 High	Melbin K Mathew	Yes

Showing 1–2 of 2 reports

Latestv1.0.4

WP fancybox

Author

Noor Alam

5.0(2)

100/100

Last Updated

2025-06-07 (1y ago)

Active Installs

1,000+

Downloads

17,606

Requires WP

4.7+

Requires PHP

Tested up to

WP 6.8.8

Created

2017-05-14 (10y ago)

WP fancybox plugin adds fancybox lightbox effect to your WordPress website. The lightbox looks great on desktop as well as mobile devices. WP fancybox Features Responsive lightbox popup using fancybox Designed with a mobile first approach so it looks great on desktop, mobile and tablet devices Quick and easy setup Open lightbox popup from either a text link or a thumbnail image link YouTube video popup Vimeo video popup Use a simple shortcode to pop up content in lightbox How to Use WP fancybox Image in lightbox Create a new post/page and use the following shortcode to create a text/image link which will open lightbox once clicked: [wp_fancybox_media url="https://example.com/wp-content/uploads/images/overlay.jpg" hyperlink="click here to pop up image"] here, url is the link to the media file that you wish to open in lightbox and hyperlink is the anchor text/image. [wp_fancybox_media url="https://example.com/wp-content/uploads/images/overlay.jpg" hyperlink="https://example.com/wp-content/uploads/images/thumb.jpg"] YouTube video in lightbox [wp_fancybox_media url="https://www.youtube.com/watch?v=Vpg9yizPP_g" hyperlink="click here to pop up youtube video"] Vimeo video in lightbox [wp_fancybox_media url="https://vimeo.com/1084537" hyperlink="click here to pop up vimeo video"] Alternate Text for an Image [wp_fancybox_media url="https://example.com/wp-content/uploads/images/overlay.jpg" hyperlink="https://example.com/wp-content/uploads/images/thumb.jpg" alt="Thumbnail image description"] Custom CSS You can specify your own CSS class in the shortcode to customize a text/image link. [wp_fancybox_media url="https://www.youtube.com/watch?v=Vpg9yizPP_g" hyperlink="click here to pop up youtube video" class="custom_class"] Multiple CSS classes can be separated with a space. For example: [wp_fancybox_media url="https://www.youtube.com/watch?v=Vpg9yizPP_g" hyperlink="click here to pop up youtube video" class="custom_class custom_class2"] For detailed documentation please visit the WordPress fancybox plugin page

View on WordPress.org