CVE-2025-15396
📋 TL;DR
The Library Viewer WordPress plugin before version 3.2.0 contains a reflected cross-site scripting (XSS) vulnerability where unsanitized parameters are echoed back in pages. This allows attackers to inject malicious scripts that execute in the browser of high-privilege users like administrators. WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- Library Viewer WordPress Plugin
⚠️ Risk & Real-World Impact
Worst Case
An attacker could steal administrator session cookies, perform actions as the administrator (like installing backdoors), or redirect users to malicious sites.
Likely Case
Attackers would typically use this to hijack admin sessions to gain unauthorized access to the WordPress dashboard.
If Mitigated
With proper input validation and output escaping, the malicious scripts would be neutralized, preventing execution.
🎯 Exploit Status
Exploitation requires tricking a high-privilege user into clicking a malicious link, but the technical execution is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.0
Vendor Advisory: https://wpscan.com/vulnerability/08790e11-019d-4680-a75f-ee0a937f8cc8/
Restart Required: No
Instructions:
1. Log into WordPress admin dashboard. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Library Viewer' and update to version 3.2.0 or later. 4. Alternatively, deactivate and delete the plugin if not needed.
🔧 Temporary Workarounds
Input Validation via Web Application Firewall (WAF)
allConfigure WAF rules to block requests containing suspicious script patterns in parameters.
Content Security Policy (CSP)
allImplement a strict CSP header to mitigate XSS impact by restricting script sources.
🧯 If You Can't Patch
- Deactivate the Library Viewer plugin immediately to remove the attack surface.
- Restrict access to the WordPress admin area to trusted IP addresses only.
🔍 How to Verify
Check if Vulnerable:
Check the plugin version in WordPress admin under Plugins > Installed Plugins. If version is below 3.2.0, it is vulnerable.Check Version:
wp plugin list --name='library-viewer' --field=versionVerify Fix Applied:
After updating, confirm the plugin version is 3.2.0 or higher in the same location.📡 Detection & Monitoring
Log Indicators:
- Unusual GET requests with script tags or JavaScript in query parameters to plugin pages.
Network Indicators:
- HTTP requests containing malicious script payloads in URL parameters.
SIEM Query:
source="wordpress.log" AND ("library-viewer" OR "library_viewer") AND (url="*<script*" OR url="*javascript:*")