I had the same warning via wordfence, but was not using fancybox! seems your live link in this post gave wordfence a false positive as the link was showing up in wordpress news section might be an idea to remove actual link? Thanks to Gennady Kovshein for clearing this up for my particular case! Hope this helps others before they go ahead & delete server files to re install like I just have :(