# Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library CVE record · `CVE-2024-5020` - **Identifiers:** `CVE-2024-5020` - **State:** Confirmed - **Severity:** CVSS 6.4 Medium - **Critical:** No - **CNA:** Wordfence - **Weakness (CWE):** [CWE-79](https://cwe.mitre.org/data/definitions/79.html) - **Tags:** [Cross-site scripting (XSS)](https://agentprime.io/advisories/tag/xss.md) - **Technologies:** [extendthemes Colibri Page Builder](https://agentprime.io/advisories/technology/extendthemes-colibri-page-builder.md) · [smub Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More](https://agentprime.io/advisories/technology/smub-envira-gallery-image-photo-gallery-albums-video-gallery-slideshows-more.md) · [bqworks Accordion Slider](https://agentprime.io/advisories/technology/bqworks-accordion-slider.md) · [Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder](https://agentprime.io/advisories/technology/form-maker-by-10web-mobile-friendly-drag-drop-contact-form-builder.md) · [jetmonsters Getwid – Gutenberg Blocks](https://agentprime.io/advisories/technology/jetmonsters-getwid-gutenberg-blocks.md) · [firelightwp Firelight Lightbox](https://agentprime.io/advisories/technology/firelightwp-firelight-lightbox.md) · [dfactory Responsive Lightbox & Gallery](https://agentprime.io/advisories/technology/dfactory-responsive-lightbox-gallery.md) · [shapedplugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel](https://agentprime.io/advisories/technology/shapedplugin-carousel-slider-photo-gallery-with-lightbox-video-slider-by-wp-caro.md) · [colorlibplugins FancyBox for WordPress](https://agentprime.io/advisories/technology/colorlibplugins-fancybox-for-wordpress.md) · [nko Visual Portfolio, Photo Gallery & Post Grid](https://agentprime.io/advisories/technology/nko-visual-portfolio-photo-gallery-post-grid.md) · [smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery](https://agentprime.io/advisories/technology/smub-photo-gallery-sliders-proofing-and-themes-nextgen-gallery.md) · [wpclever WPC Smart Quick View for WooCommerce](https://agentprime.io/advisories/technology/wpclever-wpc-smart-quick-view-for-woocommerce.md) · [posimyththemes Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder](https://agentprime.io/advisories/technology/posimyththemes-nexter-blocks-gutenberg-blocks-page-builder-ai-website-builder.md) · [Easy Social Feed Premium](https://agentprime.io/advisories/technology/easy-social-feed-premium.md) · [foliovision FV Flowplayer Video Player](https://agentprime.io/advisories/technology/foliovision-fv-flowplayer-video-player.md) - **Published:** 4 Dec 2024 - **Updated:** 8 Apr 2026 - **Reviewed by a person:** No Published by the CVE Program (CNA: Wordfence) at 4 Dec 2024, 08:22 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. ## Affected products, as the CNA wrote them - Vendor: extendthemes. Product: Colibri Page Builder. - affected: `1.0.286 and earlier` (semver) - Other versions: unaffected - Vendor: smub. Product: Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More. - affected: `1.8.15 and earlier` (semver) - Other versions: unaffected - Vendor: bqworks. Product: Accordion Slider. - affected: `1.9.12 and earlier` (semver) - Other versions: unaffected - Vendor: 10web. Product: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder. - affected: `1.15.27 and earlier` (semver) - Other versions: unaffected - Vendor: jetmonsters. Product: Getwid – Gutenberg Blocks. - affected: `2.0.11 and earlier` (semver) - Other versions: unaffected - Vendor: firelightwp. Product: Firelight Lightbox. - affected: `2.3.3 and earlier` (semver) - Other versions: unaffected - Vendor: dfactory. Product: Responsive Lightbox & Gallery. - affected: `2.4.8 and earlier` (semver) - Other versions: unaffected - Vendor: shapedplugin. Product: Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel. - affected: `2.6.8 and earlier` (semver) - Other versions: unaffected - Vendor: colorlibplugins. Product: FancyBox for WordPress. - affected: `3.3.4 and earlier` (semver) - Other versions: unaffected - Vendor: nko. Product: Visual Portfolio, Photo Gallery & Post Grid. - affected: `3.3.9 and earlier` (semver) - Other versions: unaffected - Vendor: smub. Product: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery. - affected: `3.59.4 and earlier` (semver) - Other versions: unaffected - Vendor: wpclever. Product: WPC Smart Quick View for WooCommerce. - affected: `4.1.1 and earlier` (semver) - Other versions: unaffected - Vendor: posimyththemes. Product: Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder. - affected: `4.3.1 and earlier` (semver) - Other versions: unaffected - Vendor: Easy Social Feed. Product: Easy Social Feed Premium. - affected: `6.6.2 and earlier` (semver) - Other versions: unaffected - Vendor: foliovision. Product: FV Flowplayer Video Player. - affected: `7.5.47.7212 and earlier` (semver) - Other versions: unaffected ## Not analysed yet We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter. ## Severity and exploitation - 6.4 Medium, CVSS 3.1: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N`, from CNA (Wordfence) - **CISA KEV:** Not listed. - **EPSS:** 0.0043, the 37th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days. ## Timeline This record came from the full history of the CVE Program, published 4 Dec 2024. New records show when each source confirmed them. ## Sources - [CVE List: CVE-2024-5020](https://www.cve.org/CVERecord?id=CVE-2024-5020) - [NVD: CVE-2024-5020](https://nvd.nist.gov/vuln/detail/CVE-2024-5020) ### References from the CNA - - - - - - - - - - - - - - - Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description. ## Check whether this affects you This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run. - With the agentprime MCP server (), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: - As JSON: - Everything that needs attention now: --- The web page: . Everything for agents: .