Stored Cross-Site Scripting Vulnerability in FooBox WordPress Plugin

CVE-2025-5537

What is CVE-2025-5537?

The FooBox plugin for WordPress is subject to a Stored Cross-Site Scripting flaw, stemming from inadequate input sanitization and output escaping. This vulnerability allows authenticated users, particularly those with Author-level access or higher, to inject malicious scripts through image alternative texts. When these scripts are executed on user access, it may compromise the security of the site and its visitors. To safeguard your WordPress environment, it is critical to update the FooBox plugin to the latest version and review your site's permissions and security protocols.

References