CVE-2025-15386 — Responsive Lightbox & Gallery < 2.6.1 - Unauthenticated Stored XSS
The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by…
Published: 2026-02-24 · CVSS: 8.8 · CVSS 3.1
The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious link when lightbox for comments are enabled and then approved.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7