CVE-2025-3650

jQuery Colorbox <= 4.6.3 - Contributor+ Stored XSS

The jQuery Colorbox WordPress plugin through 4.6.3 uses the colorbox library, which does not sanitize title attributes on links before using them, allowing users with at least the contributor role to conduct XSS attacks against administrators.

Affected

jQuery Colorbox

CVSS v3.1 CNA

3.5 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

EPSS

0.18% chance of exploitation in the next 30 days, 7th percentile

Published

2025-09-12

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/5afdd448-0f7e-409e-a47b-8e5c5b707639/

References

• CVE Record
• NVD entry