CVE-2024-0662: 
NixOS vulnerability analysis and mitigation

The FancyBox for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions 3.0.2 to 3.3.3 due to insufficient input sanitization and output escaping in admin settings. This vulnerability is tracked as CVE-2024-0662 and affects multi-site installations and installations where unfiltered_html has been disabled (CVE Mitre).

The vulnerability exists due to insufficient input sanitization and output escaping in the admin settings of the FancyBox for WordPress plugin. This security flaw allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages. The injected scripts will execute whenever a user accesses the affected page (CVE Mitre).

When exploited, this vulnerability allows administrator-level users to inject malicious web scripts that execute in users' browsers when they visit the compromised pages. This affects the security of multi-site WordPress installations and sites where unfiltered_html has been disabled (CVE Mitre).

The vulnerability requires an authenticated user with administrator-level permissions to exploit. The attack vector is through the admin settings interface of the FancyBox for WordPress plugin (CVE Mitre).

Users should update their FancyBox for WordPress plugin to a version newer than 3.3.3 if available. For installations where immediate updating is not possible, limiting administrator access and carefully monitoring admin activity is recommended (CVE Mitre).