CVE-2025-9710

Responsive Lightbox & Gallery < 2.5.3 - Unauthenticated Stored-XSS via Comments

The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.

Affected

Responsive Lightbox & Gallery

CVSS v3.1 CNA

6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

EPSS

0.21% chance of exploitation in the next 30 days, 11th percentile

Published

2025-10-06

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/a45c74b7-b174-479f-9681-464601b082df/

References

• CVE Record
• NVD entry