CVE-2025-5093: Responsive Lightbox & Gallery < 2.5.2 - Contributor+ Stored XSS

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-06-27 · updated 2026-06-17
Weakness: CWE-79

Description

The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Affected products

dfactory Responsive Lightbox & Gallery: before 2.5.2 — fixed in 2.5.2

How to fix

Upgrade to a fixed version: dfactory Responsive Lightbox & Gallery 2.5.2. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/1862b4a6-5570-48a4-9b09-f9659eb0e9e3/
https://wpscan.com/vulnerability/1862b4a6-5570-48a4-9b09-f9659eb0e9e3/

Get alerted when CVE-2025-5093 or the next vulnerability affects your stack