WordPress Nooni theme < 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability

The impact of this XSS vulnerability is significant. An attacker could leverage it to execute arbitrary JavaScript code within the context of a user's browser. This could be used to steal session cookies, allowing the attacker to impersonate the user. Malicious scripts could also redirect users to phishing sites, inject malware, or modify the content of the website. The blast radius extends to all users who interact with affected pages, making it a critical security concern for sites relying on the Nooni plugin. Successful exploitation requires an attacker to trick a user into clicking a malicious link or visiting a crafted URL.

Websites using the Nooni WordPress plugin, particularly those with user-supplied input fields that are not properly sanitized, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r '<script>' /var/www/html/wp-content/plugins/nooni/*

• generic web:

curl -I https://example.com/page-with-vulnerable-input?param=<script>alert(1)</script>

• wordpress / composer / npm:

wp plugin list --status=inactive | grep nooni

• wordpress / composer / npm:

wp plugin update nooni

1. 2026-03-25Disclosure

   disclosure

1. 已保留2026-02-02
2. 发布日期2026-03-25
3. 修改日期2026-04-28
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2026-25353 is to immediately upgrade the Nooni WordPress plugin to version 1.5.1 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. Web Application Firewalls (WAFs) can be configured to filter out potentially malicious input based on XSS patterns. Input validation and output encoding on the server-side can also help prevent the injection of malicious scripts. After upgrading, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into a vulnerable input field and confirming that the script is not executed.