CVE-2025-3650

Step 1: Payload Creation: An attacker, with contributor-level privileges, crafts a malicious link with a crafted title attribute containing JavaScript code (e.g., <a href="#" title="<img src=x onerror=alert(document.cookie)>">).

Step 2: Payload Insertion: The attacker inserts the malicious link into a WordPress post or page using the Colorbox plugin's functionality.

Step 3: Administrator Interaction: An administrator views the post or page containing the malicious link. The Colorbox plugin renders the link and its title attribute.

Step 4: XSS Execution: When the administrator interacts with the link (e.g., by clicking it or hovering over it, depending on the plugin's configuration), the malicious JavaScript within the title attribute is executed in the administrator's browser context.

Step 5: Impact: The executed JavaScript can perform various malicious actions, such as stealing the administrator's session cookies, redirecting the administrator to a phishing site, or defacing the website.

The vulnerability stems from a lack of proper input sanitization within the jQuery Colorbox plugin when handling title attributes of links. Specifically, the plugin fails to escape or filter malicious JavaScript code embedded within the title attribute before rendering it within the colorbox library. This allows an attacker to inject arbitrary HTML and JavaScript, which is then executed in the context of the administrator's browser when they view the page containing the crafted link. The root cause is a missing or inadequate implementation of HTML escaping or input validation on the title attribute before it is passed to the colorbox library for display. This allows for the execution of arbitrary JavaScript code, leading to XSS.