CVE-2025-3650
jQuery Colorbox <= 4.6.3 - Contributor+ Stored XSS
- State
- Published
- Severity
- 3.5 Low
- Published
- Sep 12, 2025
- Updated
- Sep 12, 2025
- Reserved
- Apr 15, 2025
Description
The jQuery Colorbox WordPress plugin through 4.6.3 uses the colorbox library, which does not sanitize title attributes on links before using them, allowing users with at least the contributor role to conduct XSS attacks against administrators.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.5 Low | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
jQuery ColorboxUnknown |
|
References
- https://wpscan.com/vulnerability/5afdd448-0f7e-409e-a47b-8e5c5b707639/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.