{
 "id": "WPSEC-2026-2801",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2801/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2801/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2801/index.md",
 "title": "FancyBox for WordPress <= 3.4.2 - Unauthenticated Regular Expression Denial of Service via Comment Links",
 "description": "The FancyBox for WordPress plugin for WordPress is vulnerable to Regular Expression Denial of Service in all versions up to, and including, 3.4.2 due to an inefficient regular expression in the link-matching selector that backtracks exponentially on crafted URLs, combined with smilies, emoji and comment avatars being able to enrol links. This makes it possible for unauthenticated attackers to post a crafted link, for example in a comment, that freezes the browser of every visitor who loads the page.",
 "plugin": {
  "slug": "fancybox-for-wordpress",
  "name": "FancyBox for WordPress",
  "full_name": "FancyBox for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/fancybox-for-wordpress/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fancybox-for-wordpress/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fancybox-for-wordpress"
 },
 "type": "DOS",
 "cwe": [
  "CWE-1333"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.1.4",
    "from_inclusive": true,
    "to": "3.4.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.1.4 before 3.4.3"
  ]
 },
 "introduced_in": "3.1.4",
 "fixed_in": "3.4.3",
 "remediation": "Update to 3.4.3 or later.",
 "fix_released": "2026-11-09T11:37:50+00:00",
 "published": "2026-11-10T11:47:16+00:00",
 "updated": "2026-11-09T23:36:04.335324+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2801/",
  "https://plugins.svn.wordpress.org/fancybox-for-wordpress/tags/3.4.3/",
  "https://wordpress.org/plugins/fancybox-for-wordpress/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fancybox-for-wordpress",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-10"
 }
}