CVE-2025-5537: Foobox WordPress Plugin XSS Vulnerability

CVE-2025-5537 Overview

CVE-2025-5537 affects the Lightbox & Modal Popup WordPress Plugin – FooBox, distributed by fooplugins. The vulnerability is a Stored Cross-Site Scripting (XSS) flaw [CWE-79] present in all versions up to and including 2.7.34. The plugin fails to properly sanitize input and escape output for image alternative text fields. Authenticated users with Author-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor who loads the affected page. The issue was disclosed on July 8, 2025.

Critical Impact
Authenticated contributors with Author privileges or higher can persist JavaScript payloads inside FooBox image galleries, enabling session theft, forced redirects, and administrative account takeover when victims render the injected content.

Affected Products

FooPlugins FooBox – Lightbox & Modal Popup WordPress Plugin (all versions ≤ 2.7.34)
WordPress sites running the foobox-image-lightbox plugin
Multi-author WordPress deployments allowing Author-level contributions

Discovery Timeline

2025-07-08 - CVE-2025-5537 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5537

Vulnerability Analysis

The FooBox plugin renders image galleries and lightbox popups using metadata supplied by content authors, including the HTML alt attribute. In vulnerable releases, the plugin writes author-supplied alternative text into rendered markup without applying WordPress escaping helpers such as esc_attr() or esc_html(). An attacker with Author-level access can embed JavaScript inside the alt-text field, which persists in the database and executes whenever a visitor views a page containing the affected image.

Because the payload is stored, the exploit does not require a phishing lure or crafted URL. Any authenticated or unauthenticated visitor rendering the affected post triggers the script. The scope change reflected in the CVSS vector indicates the injected script can act on resources beyond the vulnerable component itself, including administrator sessions when an admin previews or edits the affected content.

Root Cause

The root cause is insufficient input sanitization on write and missing output escaping on render for image alternative text fields handled by the plugin. WordPress provides context-appropriate escaping APIs, but the FooBox rendering path emitted attacker-controlled strings directly into HTML attributes and DOM contexts.

Attack Vector

Exploitation requires an authenticated account with Author privileges or higher. The attacker uploads or edits an image processed by FooBox and supplies a malicious alternative text containing HTML or JavaScript payloads. When any user loads a page that displays the FooBox gallery, the browser parses the injected markup and executes the attacker's script under the site's origin. User interaction is required — a victim must load the injected page.

Refer to the Wordfence Vulnerability Analysis and the WordPress Trac Changeset Report for the corrected sanitization logic.

Detection Methods for CVE-2025-5537

Indicators of Compromise

Image alt-text fields in WordPress media metadata containing <script>, onerror=, onload=, or javascript: sequences.
Unexpected outbound requests from browsers loading gallery pages to attacker-controlled domains.
New or modified WordPress user accounts, particularly administrator role additions, following visits by privileged users to author-generated pages.
Post revisions or media library entries created or edited by Author-level accounts that include unusual HTML in metadata fields.

Detection Strategies

Query the wp_postmeta and attachment records for _wp_attachment_image_alt values matching XSS signature patterns.
Deploy web application firewall rules that flag stored responses containing script tags inside alt attributes served by the plugin.
Monitor WordPress audit logs for image edits and post updates performed by non-administrative accounts.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record media metadata changes with user attribution.
Alert on administrator session anomalies such as unexpected settings changes or new plugin installations shortly after an admin views author-authored content.
Review Content Security Policy (CSP) violation reports for inline-script blocks originating from FooBox gallery pages.

How to Mitigate CVE-2025-5537

Immediate Actions Required

Update the FooBox – Lightbox & Modal Popup plugin to a version later than 2.7.34 as soon as the vendor's fixed release is available.
Audit all image alternative text values authored by non-administrator accounts and remove any containing HTML or JavaScript.
Restrict Author-level and higher assignments to trusted users only, and revoke unnecessary elevated roles.
Force password rotation and terminate active sessions for accounts that may have viewed injected content while authenticated as administrator.

Patch Information

The corrective changeset is tracked in the WordPress plugin repository under changeset 3322273 for foobox-image-lightbox. Review the WordPress Trac Changeset Report and the Wordfence Vulnerability Analysis for remediation details. Apply the update through the WordPress admin dashboard or via WP-CLI.

Workarounds

Temporarily deactivate the FooBox plugin until a patched version is deployed.
Enforce a strict Content Security Policy that disallows inline scripts on public-facing pages.
Limit content publishing capabilities using role-management plugins so only trusted editors can add media metadata.
Deploy a WordPress-aware WAF ruleset that sanitizes stored XSS payloads in image metadata.

bash

# Update FooBox via WP-CLI once a fixed release is published
wp plugin update foobox-image-lightbox

# Temporary mitigation: disable the plugin site-wide
wp plugin deactivate foobox-image-lightbox

# Audit stored alt-text for XSS signatures
wp db query "SELECT post_id, meta_value FROM wp_postmeta \
  WHERE meta_key='_wp_attachment_image_alt' \
  AND (meta_value LIKE '%<script%' \
   OR meta_value LIKE '%onerror=%' \
   OR meta_value LIKE '%javascript:%');"