CVE-2025-23704: Your Lightbox Reflected XSS Vulnerability

CVE-2025-23704 Overview

CVE-2025-23704 is a reflected Cross-Site Scripting (XSS) vulnerability in the Reuven Karasik Your Lightbox WordPress plugin. The flaw affects all plugin versions up to and including 1.0. It stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79].

Attackers can craft malicious URLs that, when clicked by an authenticated user, execute arbitrary JavaScript in the victim's browser session. Because the vulnerability has a scope change component, injected scripts can affect resources beyond the vulnerable component itself.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, enabling session hijacking, credential theft, and unauthorized actions performed in the victim's WordPress context.

Affected Products

Reuven Karasik Your Lightbox WordPress plugin (your-lightbox)
All versions from initial release through 1.0
WordPress sites with the plugin installed and active

Discovery Timeline

2025-03-26 - CVE-2025-23704 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23704

Vulnerability Analysis

The Your Lightbox plugin fails to properly sanitize or encode user-supplied input before reflecting it back in HTTP responses. This allows attackers to inject HTML and JavaScript payloads via crafted request parameters. The reflected nature of the flaw requires user interaction, typically through a malicious link delivered via phishing or a compromised third-party site.

The vulnerability carries a scope-changed impact, meaning injected code can affect content beyond the vulnerable plugin's security boundary. This expands the blast radius to other components rendered in the same browser context.

Root Cause

The root cause is missing or insufficient output encoding when the plugin echoes request parameters into generated HTML. WordPress provides helper functions such as esc_html(), esc_attr(), and wp_kses() for safe output, but the affected code paths in your-lightbox do not apply them consistently. As a result, attacker-controlled strings are interpreted as markup rather than literal text.

Attack Vector

An attacker constructs a URL targeting a vulnerable endpoint on a WordPress site running the Your Lightbox plugin. The URL contains a JavaScript payload in a reflected parameter. When a victim with an active session clicks the link, the payload executes in their browser. The attacker can then steal cookies, perform CSRF actions, or pivot to administrative functions if the victim holds elevated privileges. See the Patchstack WordPress Plugin Vulnerability advisory for additional context.

Detection Methods for CVE-2025-23704

Indicators of Compromise

HTTP requests to your-lightbox plugin endpoints containing <script>, javascript:, or onerror= strings in query parameters
URL-encoded payloads such as %3Cscript%3E in referer logs or web server access logs
Unexpected outbound requests from administrator browsers shortly after clicking external links

Detection Strategies

Inspect WordPress access logs for anomalous GET parameters targeting plugin paths containing your-lightbox
Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS patterns in query strings
Correlate phishing email telemetry with web requests to WordPress administrative sessions

Monitoring Recommendations

Enable verbose logging on the WordPress site, including request parameters and user-agent strings
Monitor for new or unusual administrator-level actions following user click events
Forward web server and WordPress audit logs to a centralized SIEM for correlation and retention

How to Mitigate CVE-2025-23704

Immediate Actions Required

Deactivate and remove the Your Lightbox plugin from all WordPress installations until a patched version is released
Audit user accounts, especially administrators, for unauthorized changes or new sessions
Force a password reset and session invalidation for privileged WordPress users

Patch Information

No vendor patch is currently listed in the available references. The vulnerability affects all versions through 1.0, with no fixed version identified. Monitor the Patchstack advisory for updates from the plugin author.

Workarounds

Remove the plugin entirely if a patched release is unavailable
Deploy a WAF rule that blocks requests to your-lightbox endpoints containing HTML or JavaScript payloads
Apply Content Security Policy (CSP) headers restricting inline script execution on WordPress pages
Educate administrators to avoid clicking untrusted links while authenticated to WordPress

bash

# Example WAF rule (ModSecurity) blocking reflected XSS attempts on the plugin path
SecRule REQUEST_URI "@contains your-lightbox" \
    "chain,id:1009230,phase:2,deny,status:403,msg:'Blocked CVE-2025-23704 XSS attempt'"
SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "t:none,t:urlDecodeUni,t:htmlEntityDecode"