Description

Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-03T17:17:27.580Z",
  "pubdate": "2026-09-03T17:17:27.580Z",
  "executiveSummary": "Breadcrumb NavXT versions 7.5.1 and earlier are susceptible to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability. This security flaw stems from the improper sanitization of user-supplied input before it is rendered within the web page. An unauthenticated remote attacker can exploit this by crafting a malicious URL containing a JavaScript payload. When an unsuspecting user, such as an administrator, clicks the link, the payload executes within the context of their active browser session. Successful exploitation allows an attacker to execute arbitrary JavaScript, potentially leading to unauthorized actions, session hijacking, or the exfiltration of sensitive information. Given the nature of breadcrumb navigation, these links are frequently shared or indexed, increasing the risk of accidental execution. Users of the plugin are advised to restrict access to potentially vulnerable components and monitor for patches to mitigate risks associated with client-side script injection.",
  "technicalDetails": "The vulnerability resides in the way Breadcrumb NavXT processes and reflects input parameters within the generated breadcrumb trails. The plugin fails to adequately sanitize or encode data derived from specific request parameters before reflecting them back into the HTML document object model (DOM).\nRoot Cause: The flaw is primarily an input validation and output encoding failure. The affected component takes user-controllable input from the URL parameters and embeds it directly into the HTML response without context-aware output escaping. This allows an attacker to break out of the intended HTML attribute or tag context by injecting malicious characters such as quotes, angle brackets, and event handlers.\nExploitation Method: An attacker identifies a request parameter that the plugin echoes back in the breadcrumb navigation sequence. By crafting a URL with a malicious payload (e.g., 'javascript:alert(document.cookie)'), the attacker can manipulate the DOM. When a victim loads the crafted URL, the web browser interprets the injected string as executable JavaScript rather than plain text. This is a classic reflected XSS attack vector.\nAttack Flow: 1. The attacker identifies the vulnerable URL structure used by Breadcrumb NavXT. 2. The attacker crafts a payload utilizing common XSS vectors (e.g., <script> tags or event-based attributes like onload or onerror). 3. The attacker distributes this malicious link via social engineering, phishing, or by embedding it on other websites. 4. An authenticated user or administrator clicks the link. 5. The server reflects the malicious payload into the victim's browser session. 6. The browser executes the script, allowing the attacker to interact with the site as the victim, bypass CSRF protections, or steal session tokens.\nAuthentication & Exposure: The vulnerability is unauthenticated and requires no specific privileges to trigger. It is accessible via the network to any remote attacker. The scope is limited only by the victim's interaction with the specific crafted URL, though the impact is magnified if the victim possesses administrative credentials, as the injected script can perform actions on the administrative dashboard."
}