Fancy Lightbox < 1.0.2 - Authenticated Stored Cross-Site Scripting

Description

The ‘hyperlink’ field in used while linking a remote resource (Image, Video or web page) from a URL was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a users loads a page where the plugin shortcode is used. All WordPress websites using Fancybox Lightbox version 1.0.1 and below are affected