CVE-2025-5537
📋 TL;DR
This stored XSS vulnerability in the FooBox WordPress plugin allows authenticated attackers with Author-level access or higher to inject malicious scripts into image alternative text fields. These scripts execute automatically when users view pages containing the compromised images. All WordPress sites using vulnerable FooBox plugin versions are affected.
💻 Affected Systems
- FooBox Image Lightbox WordPress Plugin
📦 What is this software?
Foobox by Fooplugins
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal admin credentials, deface websites, redirect users to malicious sites, or install backdoors for persistent access.
Likely Case
Attackers with Author access inject malicious scripts to steal session cookies or redirect users to phishing pages.
If Mitigated
With proper user access controls and content security policies, impact is limited to potential defacement of specific pages.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.35
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find FooBox Image Lightbox. 4. Click 'Update Now' if available. 5. Alternatively, download version 2.7.35+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable FooBox Plugin
allTemporarily disable the vulnerable plugin until patching is possible.
wp plugin deactivate foobox-image-lightbox
Restrict User Roles
allLimit Author-level access to trusted users only and implement principle of least privilege.
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Regularly audit user accounts and remove unnecessary Author-level permissions
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins → FooBox Image Lightbox version number.Check Version:
wp plugin get foobox-image-lightbox --field=versionVerify Fix Applied:
Confirm plugin version is 2.7.35 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual image alt text modifications by Author-level users
- Multiple failed login attempts followed by successful Author-level login
Network Indicators:
- Unexpected external script loads from WordPress pages with FooBox images
SIEM Query:
source="wordpress" (event="plugin_update" plugin_name="foobox-image-lightbox" version<"2.7.35") OR (event="user_activity" user_role="author" action="edit_post" resource_type="attachment")