Vulnerabilities / FancyBox for WordPress / WPSEC-2026-2801
FancyBox for WordPress <= 3.4.2 - Unauthenticated Regular Expression Denial of Service via Comment Links
Medium 5.3
CWE-1333Fixed in 3.4.3
- ID
- WPSEC-2026-2801
- Plugin
- FancyBox for WordPress (fancybox-for-wordpress)
- Affected
- from 3.1.4 before 3.4.3
- Remediation
- Update to 3.4.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weakness
- CWE-1333
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-10
- Attack surface
- FancyBox for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The FancyBox for WordPress plugin for WordPress is vulnerable to Regular Expression Denial of Service in all versions up to, and including, 3.4.2 due to an inefficient regular expression in the link-matching selector that backtracks exponentially on crafted URLs, combined with smilies, emoji and comment avatars being able to enrol links. This makes it possible for unauthenticated attackers to post a crafted link, for example in a comment, that freezes the browser of every visitor who loads the page.
References
- https://wpsec.com/vuln/WPSEC-2026-2801/
- https://plugins.svn.wordpress.org/fancybox-for-wordpress/tags/3.4.3/
- https://wordpress.org/plugins/fancybox-for-wordpress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS