low3.5
CVE-2025-3650
The jQuery Colorbox WordPress plugin through 4.6.3 uses the colorbox library, which does not sanitize title attributes on links before using them, allowing use…
Impact
The jQuery Colorbox WordPress plugin through 4.6.3 uses the colorbox library, which does not sanitize title attributes on links before using them, allowing users with at least the contributor role to conduct XSS attacks against administrators.
Affected products
| Product | Affected versions |
|---|---|
| JQuery Colorbox WordPress Plugin | through 4.6.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.