Unauthenticated Stored XSS Vulnerability in Responsive Lightbox & Gallery Plugin by WordPress
CVE-2025-15386
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 24 February 2026
Badges
What is CVE-2025-15386?
The Responsive Lightbox & Gallery WordPress plugin is susceptible to an Unauthenticated Stored-XSS attack due to inadequate regex replacement rules. Attackers can exploit this vulnerability by submitting a comment containing a malicious link when lightbox comments are enabled. If the comment is subsequently approved by a site administrator, the malicious script can execute within the user's browser session, thereby compromising the security of the website and its users. This issue highlights the importance of validating and sanitizing user inputs to prevent such vulnerabilities.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Responsive Lightbox & Gallery 1.7.0 < 2.6.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved