What’s Vulnerable › Vulnerabilities
CVE-2025-9710: Responsive Lightbox & Gallery < 2.5.3 - Unauthenticated Stored-XSS via Comments
- Severity: medium (CVSS 6.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-10-06 · updated 2026-10-09
Description
The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.
Affected products
- dfactory Responsive Lightbox & Gallery: before 2.5.3 — fixed in 2.5.3
How to fix
Upgrade to a fixed version: dfactory Responsive Lightbox & Gallery 2.5.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-9710 or the next vulnerability affects your stack