CVE-2025-5537 is a stored XSS vulnerability in the FooBox Lightbox & Modal Popup WordPress plugin affecting all versions up to 2.7.34. The flaw is due to insufficient input sanitization and output escaping of image alternative texts, enabling authenticated attackers with Author-level privileges or above to inject arbitrary web scripts. These scripts execute in the context of users accessing the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No patch or official remediation guidance is currently documented.

An attacker with Author-level or higher privileges can exploit this vulnerability to inject persistent malicious scripts via image alternative text fields. When other users access the compromised pages, the scripts execute in their browsers, potentially leading to limited confidentiality and integrity impacts such as theft of user data or session tokens. There is no impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider removing or sanitizing image alternative text inputs manually. Monitor official fooplugins channels for updates or patches addressing this vulnerability.