title: How does Fancybox for Wordpress got hacked?
body: <p><a href="https://wordpress.org/plugins/fancybox-for-wordpress/" rel="nofollow">Fancybox for WordPress</a> widely got hacked by ISIS. Even with latest version at this moment installed (v3.0.6), my WordPress site (v3.9.2) is still printing out the ISIS statement. The method to cure the issue is to disable / remove the plugin.</p>
  
  <p>Hacker inserts code via non-sanitized Fancybox option to "insert" codes to the site. </p>
  
  <p>However, I'm curious how can the hackers perform this kind of attack (e.g. how do they target my website? do they need to send attacks non-stop to our server? <em>my server is very slow by the way</em>)? and how to prevent these attacks in our development?</p>
  
  <p>For more details of the attack, please read <a href="http://blog.sucuri.net/2015/02/zero-day-in-the-fancybox-for-wordpress-plugin.html" rel="nofollow">this article</a>.</p>