CVE-2026-25349: Reflected XSS in Loobek WordPress Plugin

The primary impact of this XSS vulnerability lies in the attacker's ability to execute arbitrary JavaScript code within the context of a user's browser. This can be leveraged to steal session cookies, redirect users to malicious websites, or deface the website. An attacker could craft a malicious URL containing the XSS payload and trick a user into clicking it, either through social engineering or by embedding the URL in a seemingly legitimate link. Successful exploitation could lead to complete account takeover and unauthorized access to sensitive data stored within the WordPress site. The blast radius extends to all users who interact with the vulnerable plugin, particularly those who are logged in.

1. Reserved2026-02-02
2. Published2026-03-25
3. Modified2026-04-28
4. EPSS updated2026-04-02

The recommended mitigation is to immediately upgrade the Loobek WordPress plugin to version 1.5.2 or later. This version contains the necessary fix to neutralize the malicious input. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious input strings targeting the vulnerable endpoint. Input validation and output encoding on the server-side can also help reduce the attack surface. After upgrading, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) through the affected input field and confirming that the script is not executed.