CVE-2025-9710

The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.

CVSS v3.1

6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

EPSS

0.20% chance of exploitation in the next 30 days, 10th percentile

Published

2025-10-06

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/a45c74b7-b174-479f-9681-464601b082df/

References

• CVE Record
• NVD entry

Related

• CVE-2025-9706
• CVE-2025-9715
• CVE-2025-9705
• CVE-2025-9716
• CVE-2025-9704
• CVE-2025-9717