CVE-2025-5537: Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.34 - Authenticated (Author+) Stored Cross-Site Scripting
The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alternative texts in all versions up to, and including, 2.7.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5537?
CVE-2025-5537 is considered a high-severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2025-5537?
To fix CVE-2025-5537, update the FooBox plugin to version 2.7.35 or later, where the vulnerability has been patched.
Who is affected by CVE-2025-5537?
CVE-2025-5537 affects all users of the FooBox plugin for WordPress up to and including version 2.7.34.
What kind of attack can be carried out using CVE-2025-5537?
CVE-2025-5537 allows attackers to perform Stored Cross-Site Scripting attacks via vulnerable image alternative texts.
Is there a workaround for CVE-2025-5537?
Currently, the best practice is to update the FooBox plugin, as there is no known effective workaround for CVE-2025-5537.