Executive brief
Breadcrumb NavXT is a popular WordPress plugin that generates navigation breadcrumb links on website pages. An unauthenticated attacker can inject malicious scripts into the plugin that execute in visitors' browsers, potentially stealing login credentials, session cookies, or redirecting users to phishing sites. The vulnerability requires a user to click a malicious link or visit a crafted page, but affects all unpatched installations regardless of site size.
Technical details
The vulnerability is an unauthenticated Cross Site Scripting (XSS) flaw in Breadcrumb NavXT versions 7.5.1 and earlier. The plugin fails to properly sanitize or validate user-controlled input, allowing an attacker to inject JavaScript payloads that execute in the context of the page. An attacker can craft a malicious URL or page that, when visited by a user, injects arbitrary scripts into the breadcrumb navigation. The attack requires no prior authentication but does require user interaction (clicking a link or visiting a compromised page). Successful exploitation allows theft of session tokens, credential harvesting, or spreading malware. The vulnerability is patched in version 7.5.2 and later.
Affected products
- Breadcrumb NavXT Breadcrumb NavXT <=7.5.1
Timeline
- 2026-09-03: disclosed
- 2026-09-02: patched: Version 7.5.2 released