Treat title as text by default to avoid XSS vulnerability. This behavior can be overriden by options.

When the template engine properly escapes the link (image) title, for title <script>alert('foo')</script> it produces
something like <a href="" title="&lt;script&gt;alert('foo')&lt;/script&gt;"></a>.
Nothihg more could (or should be) done from the template engine side, because any other behavior would break correct title display.
Next, flybox reads the title attribute, which returns the title in the unescaped form.
If that form is used as-is and used to form a html string directly, this results in a possible XSS vulnerability.
Atm, all of fancybox, fancybox2, colorbox, lightbox2 and thickbox are vulnerable.
Update header: change name, version, and copyright info.
Rename the plugin to flybox.
Drop swf support. Who needs direct swf support nowdays? The same could be done using other types.
Drop IE≤8-specific allowTransparency attribute for iframes.