CVE-2025-47666: LambertGroup Fullscreen Slider XSS Flaw

CVE-2025-47666 Overview

CVE-2025-47666 is a Cross-Site Scripting (XSS) vulnerability affecting the Image&Video FullScreen Background WordPress plugin (lbg_fullscreen_fullwidth_slider) developed by LambertGroup. This vulnerability allows attackers to inject malicious scripts into web pages through improperly sanitized user input, resulting in Reflected XSS attacks that can execute arbitrary JavaScript in the context of a victim's browser session.

Critical Impact

This Reflected XSS vulnerability enables attackers to execute malicious scripts in users' browsers, potentially leading to session hijacking, credential theft, defacement, or redirection to malicious sites for WordPress sites using the affected plugin.

Affected Products

• Image&Video FullScreen Background plugin version 1.6.7 and earlier
• WordPress installations running the lbg_fullscreen_fullwidth_slider plugin
• All versions from initial release through <= 1.6.7

Discovery Timeline

• 2026-01-22 - CVE CVE-2025-47666 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2025-47666

Vulnerability Analysis

This vulnerability falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The plugin fails to properly sanitize or encode user-supplied input before reflecting it back in the generated HTML output. When a user visits a specially crafted URL containing malicious JavaScript, the script executes in their browser with the same privileges as the vulnerable WordPress site.

Reflected XSS attacks require social engineering to trick victims into clicking malicious links. However, once clicked, the attacker's payload executes immediately in the victim's authenticated session context. This can enable attackers to steal session cookies, capture credentials, perform actions on behalf of the user, or redirect users to phishing pages.

Root Cause

The root cause is improper neutralization of user-controlled input in the lbg_fullscreen_fullwidth_slider plugin. Input received through URL parameters or form fields is echoed back into the page response without adequate sanitization, encoding, or escaping. WordPress plugins must implement proper output escaping using functions like esc_html(), esc_attr(), or wp_kses() to prevent XSS, but this plugin fails to apply these protections consistently.

Attack Vector

An attacker exploits this vulnerability by crafting a malicious URL containing JavaScript code embedded in a vulnerable parameter. The attacker then distributes this URL through phishing emails, social media, or other channels. When a victim clicks the link while authenticated to the WordPress site, the malicious script executes in their browser session.

The attack does not require authentication to perform, but the impact is greatest when targeting authenticated WordPress administrators, as this could lead to complete site compromise through privilege escalation or arbitrary plugin/theme installation.

For detailed technical information about this vulnerability, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-47666

Indicators of Compromise

• Unusual URL parameters containing JavaScript code or HTML entities targeting pages served by the lbg_fullscreen_fullwidth_slider plugin
• Web server logs showing requests with <script> tags, event handlers (e.g., onerror, onload), or encoded JavaScript in query strings
• User reports of unexpected redirects or pop-ups when visiting specific pages on the WordPress site
• Browser console errors indicating blocked XSS attempts by Content Security Policy

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS payload patterns in incoming requests
• Monitor web server access logs for requests containing suspicious characters and encoded JavaScript in URL parameters
• Deploy browser-based XSS auditing tools and enable Content Security Policy headers to detect and prevent XSS execution
• Use WordPress security plugins to scan for known vulnerable plugin versions

Monitoring Recommendations

• Enable detailed logging for all requests to WordPress admin pages and plugin endpoints
• Configure alerting for anomalous patterns in URL parameters, particularly those containing script tags or event handlers
• Monitor for session anomalies that may indicate successful XSS-based session hijacking
• Review Content Security Policy violation reports for attempted XSS exploitation

How to Mitigate CVE-2025-47666

Immediate Actions Required

• Update the Image&Video FullScreen Background plugin to the latest patched version immediately when available
• Consider temporarily deactivating the lbg_fullscreen_fullwidth_slider plugin until a security patch is released
• Implement Content Security Policy (CSP) headers to mitigate the impact of potential XSS attacks
• Review WordPress user sessions and force re-authentication for all administrative users

Patch Information

At the time of publication, site administrators should check with LambertGroup for the latest version of the Image&Video FullScreen Background plugin. Versions <= 1.6.7 are confirmed vulnerable. Consult the Patchstack Vulnerability Report for the latest remediation guidance and patch availability information.

Workarounds

• Disable or remove the lbg_fullscreen_fullwidth_slider plugin until a patched version is available
• Implement a Web Application Firewall (WAF) with XSS filtering rules to block malicious payloads
• Add Content Security Policy headers to prevent inline script execution and restrict script sources
• Use WordPress security plugins like Wordfence or Sucuri to add additional layers of XSS protection

# Example: Add Content Security Policy header in Apache .htaccess
# Add to your WordPress root .htaccess file
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"
</IfModule>