CVE-2025-3516

The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS v3.1

5.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

EPSS

0.30% chance of exploitation in the next 30 days, 22th percentile

Published

2025-05-16

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/336a78cd-297b-4f47-a007-e33eac7f1dad/

References

• CVE Record
• NVD entry

Related

• CVE-2025-3515
• CVE-2025-3525
• CVE-2025-3514
• CVE-2025-3531
• CVE-2025-3513
• CVE-2025-3532