WordPress Loobek theme < 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerability

The primary impact of this XSS vulnerability lies in the attacker's ability to execute arbitrary JavaScript code within the context of a user's browser. This can be leveraged to steal session cookies, redirect users to malicious websites, or deface the website. An attacker could craft a malicious URL containing the XSS payload and trick a user into clicking it, either through social engineering or by embedding the URL in a seemingly legitimate link. Successful exploitation could lead to complete account takeover and unauthorized access to sensitive data stored within the WordPress site. The blast radius extends to all users who interact with the vulnerable plugin, particularly those who are logged in.

Websites utilizing the Loobek WordPress plugin, particularly those with user authentication and sensitive data, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r '<script>' /var/www/html/wp-content/plugins/loobek/*

• generic web:

curl -I https://example.com/?param=<script>alert(1)</script>

• wordpress / composer / npm:

wp plugin list | grep loobek

1. 2026-03-25Disclosure

   disclosure

1. 予約済み2026-02-02
2. 公開日2026-03-25
3. 更新日2026-04-28
4. EPSS 更新日2026-04-02

The recommended mitigation is to immediately upgrade the Loobek WordPress plugin to version 1.5.2 or later. This version contains the necessary fix to neutralize the malicious input. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious input strings targeting the vulnerable endpoint. Input validation and output encoding on the server-side can also help reduce the attack surface. After upgrading, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) through the affected input field and confirming that the script is not executed.