CVE-2025-3650

LOW

3.5

Description

The jQuery Colorbox WordPress plugin through 4.6.3 uses the colorbox library, which does not sanitize title attributes on links before using them, allowing users with at least the contributor role to conduct XSS attacks against administrators.

Details CVE

Score CVSS v3.13.5

SeveriteLOW

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisHIGH

Interaction utilisateurREQUIRED

Publie9/12/2025

Derniere modification9/15/2025

Sourcenvd

Observations honeypot0

References

https://wpscan.com/vulnerability/5afdd448-0f7e-409e-a47b-8e5c5b707639/(contact@wpscan.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.