Stored Cross-Site Scripting Vulnerability in Responsive Lightbox & Gallery Plugin by WordPress
CVE-2025-5093
Currently unrated
What is CVE-2025-5093?
The Responsive Lightbox & Gallery WordPress plugin prior to version 2.5.2 is affected by a vulnerability due to its use of the Swipebox library, which fails to validate and escape title attributes before rendering them on a page or post. This flaw allows users with a contributor role or higher to launch Stored Cross-Site Scripting attacks, potentially compromising the security of the website by executing malicious scripts within the user’s browser.
Affected Version(s)
Responsive Lightbox & Gallery 0 < 2.5.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.