The vulnerability is a stored Cross‑Site Scripting flaw caused by improper neutralization of user input during web page generation in the WP fancybox plugin. An attacker can inject malicious scripts that persist in the website’s database, causing those scripts to run in the browsers of any visitor to the affected pages. This can lead to theft of session cookies, credential hijacking, defacement, and arbitrary actions on behalf of the user.

This issue affects the WP fancybox plugin from Noor Alam, for all released versions up to and including 1.0.3. No other products or vendors are listed as impacted.

The CVSS score of 6.5 indicates a moderate risk. The EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability has not been listed in the CISA KEV catalog, reducing the likelihood that it is a currently active, high‑profile threat. The attack vector is inferred to be a web‑based input that is stored in the plugin’s database and later rendered in the frontend, so any authenticated user who can inject content or any visitor to the affected page could trigger the XSS payload.