CVE-2025-32478 Overview
CVE-2025-32478 is a Cross-Site Request Forgery (CSRF) vulnerability in the Mario Aguiar WP SexyLightBox plugin for WordPress. The flaw affects all versions up to and including 0.5.3. An attacker can leverage the CSRF weakness to inject persistent JavaScript into plugin-managed settings, producing a Stored Cross-Site Scripting (XSS) condition. Exploitation requires that an authenticated administrator visit an attacker-controlled page while logged in to the target WordPress site. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.
Critical Impact
Successful exploitation lets an unauthenticated remote attacker store malicious JavaScript that executes in the browsers of site visitors and administrators, enabling session theft, content tampering, and administrative action hijacking.
Affected Products
- Mario Aguiar WP SexyLightBox WordPress plugin
- WP SexyLightBox versions through 0.5.3
- WordPress sites running the wp-sexylightbox plugin
Discovery Timeline
- 2025-04-09 - CVE-2025-32478 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-32478
Vulnerability Analysis
The WP SexyLightBox plugin exposes a settings handler that updates plugin configuration without validating the origin of the request. Because there is no CSRF token verification, any state-changing request reaching the handler is accepted as legitimate as long as a valid administrator session cookie accompanies it. The handler also fails to sanitize or encode input before storing it, so attacker-supplied HTML and JavaScript persist in the WordPress database. When the plugin later renders the stored value in the admin dashboard or front-end output, the browser executes the injected script in the site's origin.
Root Cause
The root cause is the absence of an anti-CSRF nonce check (such as WordPress wp_verify_nonce() or check_admin_referer()) on the plugin's configuration update path. Combined with missing output escaping on the affected fields, the design defect chains a CSRF primitive into Stored XSS [CWE-352].
Attack Vector
An attacker hosts a crafted page containing an auto-submitting HTML form or fetch() request that targets the vulnerable plugin endpoint. The attacker then lures a logged-in WordPress administrator to that page through phishing, a forum post, or a malicious advertisement. The victim's browser submits the forged request with valid session cookies, and the plugin writes attacker-controlled markup into stored settings. Subsequent page views render the payload, executing JavaScript with the privileges of any user who loads the affected page.
No verified public exploit code is available. Refer to the Patchstack WordPress Vulnerability Report for additional technical details.
Detection Methods for CVE-2025-32478
Indicators of Compromise
- Unexpected <script> tags, event handlers (onerror, onload), or obfuscated JavaScript stored in WP SexyLightBox plugin settings rows within the wp_options table.
- New or modified WordPress administrator accounts created shortly after an admin session, indicating possible session-riding through the XSS payload.
- Outbound requests from administrator browsers to unfamiliar domains immediately after loading pages that render WP SexyLightBox content.
Detection Strategies
- Review HTTP access logs for POST requests to wp-admin endpoints associated with wp-sexylightbox that originate from external Referer headers.
- Hunt the WordPress database for plugin option values containing HTML tags, javascript: URIs, or base64-encoded payloads.
- Correlate administrator authentication events with subsequent plugin configuration changes that lack a corresponding admin UI navigation pattern.
Monitoring Recommendations
- Enable WordPress audit logging to capture every plugin settings change with the acting user, IP address, and timestamp.
- Deploy a Web Application Firewall (WAF) rule that blocks requests to WP SexyLightBox admin handlers when the Referer header is absent or off-domain.
- Alert on Content Security Policy (CSP) violation reports indicating inline script execution on WordPress admin pages.
How to Mitigate CVE-2025-32478
Immediate Actions Required
- Deactivate and remove the WP SexyLightBox plugin until a vendor patch is published, since no fixed version is listed in the advisory.
- Audit plugin settings and post content for injected script payloads, and purge any unauthorized HTML from wp_options and post meta tables.
- Rotate WordPress administrator passwords and invalidate active sessions to revoke any tokens captured through prior exploitation.
Patch Information
The Patchstack advisory lists all versions through 0.5.3 as affected, and no patched release is identified in the available data. Monitor the Patchstack WordPress Vulnerability Report and the WordPress plugin repository for an updated build that introduces nonce validation and output encoding.
Workarounds
- Restrict access to /wp-admin/ using IP allow-listing or VPN-only access to reduce the chance that administrators encounter cross-origin forgery vectors.
- Enforce a strict Content Security Policy that disallows inline scripts and unknown external script origins on WordPress pages.
- Require administrators to log out of WordPress when browsing untrusted sites, and use a dedicated browser profile for administrative tasks.
# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate wp-sexylightbox
wp plugin delete wp-sexylightbox
# Search the database for suspicious script content in plugin options
wp db query "SELECT option_name, option_value FROM wp_options WHERE option_name LIKE '%sexylightbox%' AND option_value REGEXP '<script|javascript:|onerror=';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
