CVE-2019-16524

The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is no inline styles output filter.

• CWE-79

• https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190911-01_Easy_FancyBox_WP_Plugin_Stored_XSSExploit, Third Party Advisory
• https://wordpress.org/plugins/easy-fancybox/#developersProduct, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9891Exploit, Third Party Advisory
• https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190911-01_Easy_FancyBox_WP_Plugin_Stored_XSSExploit, Third Party Advisory
• https://wordpress.org/plugins/easy-fancybox/#developersProduct, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9891Exploit, Third Party Advisory

Published

Sep 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16519ESET Cyber Security 6.7.900.0 for macOS allows a local attac…7.8
• CVE-2019-1652A vulnerability in the web-based management interface of Cis…7.2
• CVE-2019-16520The all-in-one-seo-pack plugin before 3.2.7 for WordPress (a…5.4
• CVE-2019-16521The broken-link-checker plugin through 1.11.8 for WordPress …6.1
• CVE-2019-16522The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU…4.8
• CVE-2019-16523The events-manager plugin through 5.9.5 for WordPress (aka E…5.4
• CVE-2019-16525An XSS issue was discovered in the checklist plugin before 1…6.1
• CVE-2019-16528An issue was discovered in the AbuseFilter extension for Med…7.5
• CVE-2019-16529An issue was discovered in the CheckUser extension through 1…5.3
• CVE-2019-1653A vulnerability in the web-based management interface of Cis…7.5
• CVE-2019-16530Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x…7.2
• CVE-2019-16531LayerBB before 1.1.4 has multiple CSRF issues, as demonstrat…8.8