# FancyBox for WordPress <= 3.4.2 - Unauthenticated Regular Expression Denial of Service via Comment Links

- **ID:** WPSEC-2026-2801
- **Plugin:** FancyBox for WordPress (`fancybox-for-wordpress`), https://wordpress.org/plugins/fancybox-for-wordpress/
- **Affected versions:** from 3.1.4 before 3.4.3
- **Fixed in:** 3.4.3 (Update to 3.4.3 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
- **Weakness:** CWE-1333
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fancybox-for-wordpress
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2801/

## Description

The FancyBox for WordPress plugin for WordPress is vulnerable to Regular Expression Denial of Service in all versions up to, and including, 3.4.2 due to an inefficient regular expression in the link-matching selector that backtracks exponentially on crafted URLs, combined with smilies, emoji and comment avatars being able to enrol links. This makes it possible for unauthenticated attackers to post a crafted link, for example in a comment, that freezes the browser of every visitor who loads the page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2801/
- https://plugins.svn.wordpress.org/fancybox-for-wordpress/tags/3.4.3/
- https://wordpress.org/plugins/fancybox-for-wordpress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2801/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.