8.8
High
CVE-2025-15386 The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack…
Description
The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious link when lightbox for comments are enabled and then approved.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Responsive Lightbox & Gallery 1.7 | 1.7.0 → < 2.6.1 | 2.6.1 |
Other CVEs of Responsive Lightbox & Gallery
The 4 CVEs of Responsive Lightbox & Gallery →
CVE-2025-9710
The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes…
6.3
Medium
CVE-2025-5093
The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and…
5.4
Medium
CVE-2025-3742
The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes…
6.8
Medium