Colorlib

10 CVEs across 11 Colorlib products. Browse Colorlib vulnerabilities, severities, and proof-of-concept exploits.

Colorlib products with known CVEs

ProductCVEs
Activello3
Fancybox3
Bonkers2
Coming Soon \& Maintenance Mode2
Illdy2
Newspaper X2
Pixova Lite2
Shapely2
Activello Theme1
Simple Custom Post Order1
Sparklinkg1
Colorlib CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-3662Medium6.12025-06-03The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issu…
CVE-2024-49321Medium4.32024-10-21Missing Authorization vulnerability in colorlibplugins Simple Custom Post Order simple-custom-post-order allows Exploiting Incorrectly Configured Access Contro…
CVE-2024-0662Medium4.42024-04-09The FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions 3.0.2 to 3.3.3 due to insufficient…
CVE-2024-1473Medium5.32024-03-20The Coming Soon & Maintenance Mode by Colorlib plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.99 via the…
CVE-2020-36721Medium6.52023-06-07The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the…
CVE-2020-36708Critical9.82023-06-07The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0…
CVE-2022-45849Medium5.42023-04-16Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Silkalns Activello theme <= 1.4.4 versions.
CVE-2022-45358Medium5.42023-04-13Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Silkalns Activello theme <= 1.4.4 versions.
CVE-2022-1945Medium4.82022-06-20The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high privilege users such as…
CVE-2015-14942015-02-17The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting (…