CVE-2025-3745

The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.

CVSS v3.1

6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

EPSS

0.21% chance of exploitation in the next 30 days, 12th percentile

Published

2025-06-30

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/1b50f686-c2e0-4963-95c8-b27137dcc059/

References

• CVE Record
• NVD entry

Related

• CVE-2025-3742
• CVE-2025-3762
• CVE-2025-3730
• CVE-2025-3763
• CVE-2025-3729
• CVE-2025-3764