CVE-2025-54051: LightBox Block Stored XSS Vulnerability

CVE-2025-54051 Overview

CVE-2025-54051 is a stored cross-site scripting (XSS) vulnerability in the bPlugins LightBox Block plugin for WordPress. The plugin fails to neutralize user-supplied input during web page generation, allowing authenticated contributors to inject persistent JavaScript payloads. The flaw affects all lightbox-block versions up to and including 1.1.30. The vulnerability is classified under CWE-79 and requires low privileges plus user interaction to trigger. Successful exploitation impacts confidentiality, integrity, and availability across trust boundaries because the injected script executes in visitors' browser sessions.

Critical Impact
Authenticated attackers can plant persistent scripts that hijack sessions, redirect users, or perform actions on behalf of administrators who view affected content.

Affected Products

bPlugins LightBox Block plugin for WordPress
All versions from initial release through 1.1.30
WordPress sites permitting contributor-level or higher registration

Discovery Timeline

2025-07-16 - CVE-2025-54051 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54051

Vulnerability Analysis

The LightBox Block plugin registers a Gutenberg block that accepts user-controlled attributes rendered into the final HTML output. The plugin does not properly sanitize or escape these attributes before they reach the browser. An authenticated user with block-editing capabilities can embed a crafted payload inside a block attribute. When another user, including administrators, loads the affected post or page, the injected script executes in their browser context.

The scope change indicates the payload escapes its original security context. Because WordPress renders blocks in both the front-end and administrative previews, the payload can target site visitors and privileged reviewers. Attackers commonly use stored XSS to exfiltrate authentication cookies, insert malicious redirects, or perform administrative actions through forged requests. Refer to the Patchstack XSS Vulnerability Report for the vendor-facing technical details.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Block attributes accepted from the editor are concatenated into rendered markup without applying WordPress escaping helpers such as esc_attr(), esc_html(), or wp_kses_post(). Any HTML or JavaScript submitted through a permitted block attribute is preserved verbatim in output.

Attack Vector

The attack requires network access to the WordPress instance and an authenticated account with permission to create or edit posts containing the LightBox block. The attacker crafts a block whose attribute contains a script payload, saves the content, and waits for a victim to render the page. Exploitation depends on user interaction, meaning the victim must load the compromised post or preview.

No verified proof-of-concept code is published for this vulnerability. The exploitation pattern follows standard stored XSS techniques against Gutenberg block attributes. See the Patchstack advisory for additional context.

Detection Methods for CVE-2025-54051

Indicators of Compromise

Post or page content containing <script>, onerror=, onload=, or javascript: tokens inside LightBox block attributes
Unexpected outbound requests from administrator browser sessions after loading posts using the LightBox block
New administrator accounts or option changes correlated with editor activity by low-privileged users
Contributor or author accounts modifying block markup outside their normal editorial patterns

Detection Strategies

Query the wp_posts table for post_content entries referencing wp:bplugins/lightbox-block alongside HTML event handlers or <script> tags
Enable and review WordPress audit logs for post revisions authored by non-administrator roles
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from post content
Use a web application firewall to log requests posting block attributes that contain script syntax

Monitoring Recommendations

Alert on plugin version telemetry showing lightbox-block at or below 1.1.30
Monitor administrator session cookies for reuse from unexpected IP addresses following content review actions
Track WordPress REST API POST requests to /wp/v2/posts and /wp/v2/pages containing suspicious HTML in block attributes
Review front-end error telemetry for CSP violations tied to post rendering

How to Mitigate CVE-2025-54051

Immediate Actions Required

Update the bPlugins LightBox Block plugin to a release later than 1.1.30 once the vendor publishes a fixed version
Audit existing posts and pages for embedded LightBox blocks containing script payloads and remove or sanitize them
Restrict block-editing privileges to trusted users and remove contributor accounts that are no longer required
Rotate administrator session cookies and credentials if suspicious content was rendered by privileged users

Patch Information

The Patchstack advisory lists all versions through 1.1.30 as vulnerable. Site administrators should monitor the plugin's WordPress.org listing and the Patchstack XSS Vulnerability Report for a fixed release. Apply the vendor patch through the WordPress plugin updater as soon as it becomes available.

Workarounds

Temporarily deactivate the LightBox Block plugin until a patched version is available
Enforce a strict Content Security Policy that blocks inline scripts on public post pages
Reduce editorial roles so that only administrators and editors can create or modify posts using the affected block
Deploy a virtual patch through a web application firewall to strip script payloads submitted via the WordPress REST API

bash

# Configuration example: disable the plugin from WP-CLI until a fix ships
wp plugin deactivate lightbox-block
wp plugin status lightbox-block