CVE-2025-47666: LambertGroup Slider XSS Vulnerability

CVE-2025-47666 Overview

CVE-2025-47666 is a reflected Cross-Site Scripting (XSS) vulnerability in the LambertGroup Image&Video FullScreen Background plugin (lbg_fullscreen_fullwidth_slider) for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can craft a malicious link that, when clicked by an authenticated or unauthenticated victim, executes arbitrary JavaScript in the victim's browser under the site's origin. The vulnerability affects all versions of the plugin up to and including 1.6.7. Exploitation requires user interaction but no privileges, and the impact crosses a security boundary due to browser-context script execution.

Critical Impact
Successful exploitation allows attackers to run arbitrary JavaScript in a victim's session, enabling credential theft, session hijacking, and unauthorized actions on the affected WordPress site.

Affected Products

LambertGroup Image&Video FullScreen Background plugin (lbg_fullscreen_fullwidth_slider)
All versions from n/a through 1.6.7
WordPress sites using the vulnerable plugin

Discovery Timeline

2026-01-22 - CVE-2025-47666 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47666

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the lbg_fullscreen_fullwidth_slider WordPress plugin. The plugin reflects user-controlled input back into rendered HTML output without applying proper output encoding or input sanitization. When a victim visits a specially crafted URL, the attacker-controlled payload is rendered as executable script within the page context.

Because the scope changes on exploitation, injected script executes with access to the WordPress site origin. This allows attackers to interact with authenticated user sessions, exfiltrate cookies not marked HttpOnly, and perform Cross-Site Request Forgery (CSRF) actions using the victim's privileges. The Exploit Prediction Scoring System (EPSS) probability is 0.263%.

Root Cause

The root cause is failure to sanitize or escape input before echoing it into the HTML response. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() for safe output rendering, but the plugin does not apply them consistently to parameters reflected into the response body.

Attack Vector

An attacker crafts a URL containing a JavaScript payload in a vulnerable parameter processed by the plugin. The attacker delivers this URL through phishing, social media, or malicious redirects. When the victim loads the URL, the server reflects the payload into the page, and the browser executes it. The attack requires user interaction (UI:R) but no authentication.

See the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-47666

Indicators of Compromise

HTTP requests to WordPress endpoints containing script-like payloads such as <script>, onerror=, or javascript: in query parameters processed by lbg_fullscreen_fullwidth_slider.
Unexpected outbound requests from user browsers to attacker-controlled domains following visits to the WordPress site.
Web server access logs showing unusually long or URL-encoded query strings targeting plugin parameters.

Detection Strategies

Inspect web application firewall (WAF) logs for reflected XSS signatures targeting plugin request paths.
Correlate referer headers pointing to external domains with subsequent suspicious session activity in WordPress admin logs.
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution attempts.

Monitoring Recommendations

Monitor WordPress plugin inventories for the presence of Image&Video FullScreen Background at version 1.6.7 or earlier.
Alert on administrative account activity originating from unusual IP addresses or geolocations shortly after a user clicks an external link.
Track outbound HTTP requests from browsers to previously unseen domains referencing site cookies.

How to Mitigate CVE-2025-47666

Immediate Actions Required

Deactivate the Image&Video FullScreen Background plugin until a patched version is confirmed available from LambertGroup.
Audit WordPress administrator sessions and force re-authentication for privileged users.
Deploy a WAF rule to block requests containing script tags or event handlers targeting plugin parameters.

Patch Information

No fixed version has been published at the time of NVD publication. Consult the Patchstack Vulnerability Report for updates on vendor remediation and monitor the LambertGroup vendor page for a release addressing versions above 1.6.7.

Workarounds

Remove or disable the lbg_fullscreen_fullwidth_slider plugin from all WordPress installations.
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and Secure flags on WordPress session cookies to reduce impact of script execution.
Enable a virtual patching capability through a WAF such as Patchstack or equivalent to filter reflected XSS payloads.

bash

# Example WAF rule pattern (ModSecurity)
SecRule ARGS "@rx (?i)(<script|onerror=|javascript:|onload=)" \
  "id:1004766,phase:2,deny,status:403,msg:'Reflected XSS attempt against lbg_fullscreen_fullwidth_slider'"