← CVE Intelligence

CVE-2025-3650

jQuery Colorbox <= 4.6.3 - Contributor+ Stored XSS PUBLISHED

Description (CNA)

The jQuery Colorbox WordPress plugin through 4.6.3 uses the colorbox library, which does not sanitize title attributes on links before using them, allowing users with at least the contributor role to conduct XSS attacks against administrators.

Affected (CNA)

Vendor / productVersions
Unknown / jQuery Colorboxaffected 0 through 4.6.3

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.