CVE-2025-15386
High
Description
The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious link when lightbox for comments are enabled and then approved.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Responsive Lightbox & Gallery
PublishedFeb 24, 2026
First seenFeb 24, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- Responsive Lightbox & Gallery2.6.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Responsive Lightbox & Gallery | 1.7.0 ≤ v < 2.6.1 | 2.6.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.