CVE-2025-9710

Responsive Lightbox & Gallery < 2.5.3 - Unauthenticated Stored-XSS via Comments

CVSS 6.3 MEDIUMEPSS 0.2%

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.3EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

06 Oct 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Affected products

Unknown · Responsive Lightbox & Gallery

References

https://wpscan.com/vulnerability/a45c74b7-b174-479f-9681-464601b082df/