Medium severity4.8NVD Advisory· Published Sep 26, 2019· Updated Jun 17, 2026
CVE-2019-16524
CVE-2019-16524
Description
The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is no inline styles output filter.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- WordPress/easy-fancyboxdescription
Patches
Vulnerability mechanics
References
3- github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190911-01_Easy_FancyBox_WP_Plugin_Stored_XSSnvdExploitThird Party Advisory
- wpvulndb.com/vulnerabilities/9891nvdExploitThird Party Advisory
- wordpress.org/plugins/easy-fancybox/nvdProductThird Party Advisory
News mentions
0No linked articles in our index yet.