CVE-2025-28935

Summary

CVE-2025-28935 is a Cross-site Scripting (XSS) vulnerability affecting the puzich Fancybox Plus web component. The issue stems from improper neutralization of user inputs during web page generation, which enables attackers to inject malicious scripts into a targeted website. This vulnerability exists in versions of Fancybox Plus from n/a through 1.0.1 and can potentially be exploited for stealing sensitive user information or performing unauthorized actions. Users are strongly advised to update to the latest, secure version of the component as soon as possible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.