In reply to Ryan Hellyer.

In case there is any confusion here, this appears to be a flaw in the FancyBox for WordPress plugin, not in FancyBox itself. which is just a jQuery plugin.
That seems to be a widespread misunderstanding as I'm getting some questions about security of my plugin (Easy FancyBox) because of this... Hope it is clear this particular vulnerability does not necessarily concern other FancyBox plugins.