CVE-2025-15386 — Responsive Lightbox & Gallery < 2.6.1 - Unauthenticated Stored XSS

CVE-2025-15386

Responsive Lightbox & Gallery < 2.6.1 - Unauthenticated Stored XSS PUBLISHED

Description (CNA)

The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious link when lightbox for comments are enabled and then approved.

Affected (CNA)

Vendor / product	Versions
Unknown / Responsive Lightbox & Gallery	affected 1.7.0 before 2.6.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/fa3a84b6-6d5d-4e10-8587-ae49c127483b/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.