PT-2026-21665 · WordPress · Responsive Lightbox & Gallery

Matthew Rollings · Publicado 2026-02-24 · Atualizado 2026-03-01 · CVE-2025-15386

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Responsive Lightbox & Gallery WordPress plugin versions prior to 2.6.1

Description The software contains a flaw in its regex replacement rules that allows for an Unauthenticated Stored-XSS attack. This occurs when a malicious link is posted as a comment, and then approved with lightbox for comments enabled. The issue allows an attacker to inject malicious code that will be executed when other users view the comment.

Recommendations Update to version 2.6.1 or later.

Exploit

Correção

Identificadores relacionados

CVE-2025-15386

Produtos afetados

Responsive Lightbox & Gallery

Referências · 8

• 🔥 https://wpscan.com/vulnerability/fa3a84b6-6d5d-4e10-8587-ae49c127483b · Exploit
• https://twitter.com/VulmonFeeds/status/2026253689392869473 · Publicação no Twitter
• https://twitter.com/cracbot/status/2027700470014480786 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-15386 · Nota de Segurança
• https://twitter.com/cracbot/status/2028062781254381933 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2026184592668172588 · Publicação no Twitter
• https://t.me/CVEtracker/45577 · Publicação no Telegram
• https://twitter.com/TheHackerWire/status/2026351601527697919 · Publicação no Twitter