CVE-2025-3649 - Vulnerability Details - OpenCVE

The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00094.

Exploitation poc

Automatable no

Technical Impact total

Vendors	Products
Lightpress	Lightbox

Configuration 1 [-]

cpe:2.3:a:lightpress:lightbox:*:*:*:*:*:wordpress:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://wpscan.com/vulnerability/37fb7f3b-1766-4c2c-9b78-f77f15a04476/

History

Thu, 05 Jun 2025 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Lightpress Lightpress lightbox
Weaknesses		CWE-79
CPEs		cpe:2.3:a:lightpress:lightbox::::::wordpress::*
Vendors & Products		Lightpress Lightpress lightbox

Mon, 12 May 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 12 May 2025 06:15:00 +0000

Type	Values Removed	Values Added
Description		The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks.
Title		LightPress Lightbox < 2.3.4 - Contributor+ Stored XSS
References		https://wpscan.com/vulnerability/37fb7f3b-1766-4c2c-9b78-f77f15a04476/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2025-05-12T06:00:03.668Z

Updated: 2025-05-12T17:03:04.531Z

Reserved: 2025-04-15T14:42:22.990Z

Link: CVE-2025-3649

Vulnrichment

Updated: 2025-05-12T17:02:33.168Z

NVD

Status : Analyzed

Published: 2025-05-12T06:15:40.270

Modified: 2025-06-05T14:27:28.437

Link: CVE-2025-3649

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3649", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2025-04-15T14:42:22.990Z", "datePublished": "2025-05-12T06:00:03.668Z", "dateUpdated": "2025-05-12T17:03:04.531Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2025-05-12T06:00:03.668Z"}, "title": "LightPress Lightbox < 2.3.4 - Contributor+ Stored XSS", "problemTypes": [{"descriptions": [{"description": "CWE-79 Cross-Site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "LightPress Lightbox", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "2.3.4"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks."}], "references": [{"url": "https://wpscan.com/vulnerability/37fb7f3b-1766-4c2c-9b78-f77f15a04476/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Pierre Rudloff", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-12T17:02:38.877674Z", "id": "CVE-2025-3649", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-12T17:03:04.531Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-3649", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-12T17:02:38.877674Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-12T17:02:33.168Z"}}], "cna": {"title": "LightPress Lightbox < 2.3.4 - Contributor+ Stored XSS", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "LightPress Lightbox", "versions": [{"status": "affected", "version": "0", "lessThan": "2.3.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/37fb7f3b-1766-4c2c-9b78-f77f15a04476/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-79 Cross-Site Scripting (XSS)"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2025-05-12T06:00:03.668Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3649", "state": "PUBLISHED", "dateUpdated": "2025-05-12T17:03:04.531Z", "dateReserved": "2025-04-15T14:42:22.990Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2025-05-12T06:00:03.668Z", "assignerShortName": "WPScan"}, "dataVersion": "5.1"}