CVE-2025-28978: SB Breadcrumbs Reflected XSS Vulnerability

CVE-2025-28978 Overview

CVE-2025-28978 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the SB Breadcrumbs WordPress plugin developed by Hung Trang Si. This vulnerability stems from improper neutralization of user input during web page generation, allowing attackers to inject malicious scripts that execute in the context of a victim's browser session.

The vulnerability enables attackers to craft malicious URLs containing JavaScript payloads. When unsuspecting users click these links while authenticated to a WordPress site using the vulnerable plugin, the malicious script executes with the user's privileges, potentially leading to session hijacking, credential theft, or administrative account compromise.

Critical Impact

Attackers can execute arbitrary JavaScript in authenticated user sessions, potentially compromising WordPress administrator accounts and gaining full site control.

Affected Products

• SB Breadcrumbs WordPress Plugin version 1.0 and earlier
• WordPress sites with sb-breadcrumbs plugin installed

Discovery Timeline

• 2025-07-04 - CVE CVE-2025-28978 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-28978

Vulnerability Analysis

This Reflected XSS vulnerability (CWE-79) exists within the SB Breadcrumbs plugin's input handling mechanism. The plugin fails to properly sanitize user-controllable input before reflecting it back in the generated HTML output. This lack of input validation creates an injection point where attackers can insert malicious JavaScript code.

The attack requires user interaction, as the victim must click on a specially crafted malicious link. Once clicked, the injected script executes within the security context of the vulnerable WordPress site, inheriting the victim's session and permissions. This cross-origin capability means the attacker's script can perform actions as the logged-in user, including administrative operations if the victim has elevated privileges.

Root Cause

The root cause is improper neutralization of special characters in user input before it is included in web page output. The SB Breadcrumbs plugin does not adequately escape or sanitize input parameters, allowing HTML and JavaScript code to be injected and rendered by the browser. This represents a failure to implement output encoding or input validation for web page generation.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a malicious URL containing JavaScript payload within a parameter processed by the SB Breadcrumbs plugin. The attacker then distributes this URL through phishing emails, social media, or other channels. When an authenticated WordPress user clicks the link, the malicious script executes in their browser session.

The scope is changed, meaning the vulnerability can affect resources beyond the vulnerable component itself. This allows the attacker to potentially access cookies, session tokens, or other sensitive information from the affected WordPress domain.

Detection Methods for CVE-2025-28978

Indicators of Compromise

• Unusual URL patterns in web server logs containing sb-breadcrumbs with encoded JavaScript payloads
• Suspicious outbound connections from user browsers after visiting WordPress pages with breadcrumb navigation
• Reports from users about unexpected behavior or redirects when clicking internal site links
• JavaScript execution errors in browser developer consoles related to breadcrumb elements

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS patterns in URL parameters
• Monitor web server access logs for requests containing encoded script tags (%3Cscript%3E) targeting breadcrumb-related endpoints
• Enable Content Security Policy (CSP) headers with violation reporting to detect inline script execution attempts
• Deploy browser-based XSS protection mechanisms and monitor for triggered alerts

Monitoring Recommendations

• Configure real-time alerting for suspicious URL patterns in HTTP requests
• Review WordPress audit logs for unexpected administrative actions that could indicate session hijacking
• Monitor for unusual patterns in user session behavior following external link referrals
• Implement log analysis to correlate potential XSS attempts with subsequent suspicious authenticated actions

How to Mitigate CVE-2025-28978

Immediate Actions Required

• Deactivate and remove the SB Breadcrumbs (sb-breadcrumbs) plugin from all WordPress installations
• Audit WordPress user accounts for signs of compromise, particularly administrative accounts
• Review recent administrative actions in WordPress logs for unauthorized changes
• Consider implementing a Web Application Firewall (WAF) with XSS filtering capabilities

Patch Information

No patch information is currently available for this vulnerability. The Patchstack Vulnerability Report provides additional details on the vulnerability status. Site administrators should consider removing the plugin and finding an alternative breadcrumb solution until a security update is released.

Workarounds

• Remove the SB Breadcrumbs plugin entirely and replace with a maintained alternative breadcrumb plugin
• Implement Content Security Policy (CSP) headers to restrict inline script execution
• Deploy a WAF solution with XSS pattern detection and blocking capabilities
• Educate users about the risks of clicking suspicious links, even when they appear to point to trusted internal sites

# WordPress CLI command to deactivate and delete the vulnerable plugin
wp plugin deactivate sb-breadcrumbs --path=/var/www/html/wordpress
wp plugin delete sb-breadcrumbs --path=/var/www/html/wordpress

# Add Content Security Policy header in Apache (.htaccess)
# Header set Content-Security-Policy "default-src 'self'; script-src 'self'"