Project: 
Colorbox Inline
Date: 
2026-May-13
Security risk: 
Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: 
Cross-site scripting
Affected versions: 
<2.1.1
CVE IDs: 
CVE-2026-8493
Description: 

This module enables you to open content already on the page within a colorbox.

The module doesn't sufficiently sanitize the data-colorbox-inline attribute value before passing it to jQuery, leading to a Cross-Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: