Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

CVE Database V5

GCVE Database

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS

CVE-2025-3662 is a stored Cross-Site Scripting (XSS) vulnerability affecting the FancyBox for WordPress plugin versions prior to 3.3.6. FancyBox is a popular plugin used to create image galleries with captions and titles on WordPress sites. The vulnerability arises because the plugin fails to properly escape the captions and titles attributes before rendering them in gallery caption fields. This improper sanitization allows an attacker to inject malicious JavaScript code that is stored persistently within the gallery metadata. Notably, the vulnerability was initially reported as requiring contributor-level privileges but was escalated to an unauthenticated stored XSS, meaning an attacker does not need to be logged in or have any privileges to exploit it. When a victim visits a page containing the malicious gallery, the injected script executes in their browser context, potentially leading to session hijacking, defacement, or other client-side attacks. The CVSS 3.1 base score is 6.1 (medium severity), reflecting that the attack vector is network-based with low attack complexity, no privileges required, but requiring user interaction (victim visiting the page). The scope is changed, indicating that the vulnerability affects components beyond the initially vulnerable plugin, possibly impacting the broader WordPress site or user sessions. No known exploits are currently reported in the wild, and no official patch links are provided yet, but the fixed version is 3.3.6 or later. This vulnerability falls under CWE-79, a common and dangerous web application security weakness related to improper input validation and output encoding.

Detailed information about CVE-2025-3662: CWE-79 Cross-Site Scripting (XSS) in Unknown FancyBox for WordPress affecting Unknown FancyBox for WordPress. Get real

CVE-2025-3662: CWE-79 Cross-Site Scripting (XSS) in Unknown FancyBox for WordPress - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-3662: CWE-79 Cross-Site Scripting (XSS) in FancyBox for WordPress

Threats Tagged 'cve-2025-3662'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-3662'

Lead Pen Test Professional