CVE-2025-23704: Your Lightbox Plugin XSS Vulnerability

CVE-2025-23704 Overview

CVE-2025-23704 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the Your Lightbox WordPress plugin developed by Reuven Karasik. The flaw stems from improper neutralization of user input during web page generation, classified under [CWE-79]. An attacker can craft a malicious URL that, when clicked by an authenticated user, executes arbitrary JavaScript in the victim's browser session. The vulnerability affects all versions of Your Lightbox up to and including version 1.0.

Critical Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions within the WordPress site.

Affected Products

• Reuven Karasik Your Lightbox WordPress plugin
• All versions from n/a through 1.0
• WordPress sites with the your-lightbox plugin installed and active

Discovery Timeline

• 2025-03-26 - CVE-2025-23704 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23704

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the Your Lightbox WordPress plugin. The plugin fails to properly sanitize or encode user-supplied input before reflecting it back into HTTP responses. When a victim visits a crafted URL containing malicious JavaScript payloads, the unsanitized input is rendered as part of the HTML page, causing the browser to execute the attacker's script.

The scope change indicated by the CVSS vector means the impact extends beyond the vulnerable component itself. An attacker can leverage this flaw to affect other components or users interacting with the compromised page. User interaction is required, typically through phishing or social engineering, to trigger the payload.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin accepts input parameters from HTTP requests and embeds them directly into the response HTML without applying context-appropriate output encoding or sanitization. Functions such as esc_html(), esc_attr(), or wp_kses() provided by the WordPress API were not used on reflected parameters.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a malicious URL containing a JavaScript payload in a vulnerable parameter. The attacker then delivers this URL to a target through email, messaging platforms, or malicious websites. When the victim clicks the link while authenticated to the WordPress site, the payload executes in their browser.

The vulnerability mechanism follows the classic reflected XSS pattern: a request parameter is echoed back into the HTML response without encoding, allowing injected <script> tags or event handlers to execute. See the Patchstack Plugin Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-23704

Indicators of Compromise

• HTTP request logs containing URL parameters with encoded <script>, javascript:, or event handler patterns such as onerror= and onload=
• Referrer headers pointing to suspicious external domains preceding requests to Your Lightbox plugin endpoints
• Unexpected outbound requests from authenticated user sessions to attacker-controlled domains
• Browser console errors or anomalous JavaScript execution on pages rendered by the your-lightbox plugin

Detection Strategies

• Inspect web server access logs for requests containing reflected parameters with HTML or JavaScript metacharacters such as <, >, ", and '
• Deploy a Web Application Firewall (WAF) with rules tuned to detect reflected XSS payload signatures targeting WordPress plugin endpoints
• Monitor for anomalous client-side activity, including unexpected DOM modifications and cross-origin requests from authenticated sessions

Monitoring Recommendations

• Forward WordPress and web server logs into a centralized SIEM for correlation and retention
• Enable Content Security Policy (CSP) reporting endpoints to capture violations indicative of injected scripts
• Track authenticated session activity for signs of account takeover such as unexpected privilege changes or content modifications

How to Mitigate CVE-2025-23704

Immediate Actions Required

• Deactivate and remove the Your Lightbox plugin from any WordPress installation running version 1.0 or earlier until a patched release is available
• Audit WordPress administrator and editor accounts for unauthorized changes following the disclosure date
• Implement a Content Security Policy that restricts inline script execution and limits permitted script sources

Patch Information

At the time of publication, no vendor-supplied patched version is referenced in the available advisory data. Refer to the Patchstack Plugin Vulnerability Report for current vendor status and any updated remediation guidance.

Workarounds

• Remove the your-lightbox plugin and replace it with an actively maintained alternative that provides equivalent functionality
• Deploy WAF rules that block requests containing reflected XSS payload patterns targeting plugin parameters
• Train users with administrative or editorial privileges to recognize phishing attempts that deliver crafted URLs
• Enforce least-privilege access on WordPress accounts to limit the impact of session compromise

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate your-lightbox
wp plugin delete your-lightbox