PT-2026-21665 · WordPress · Responsive Lightbox & Gallery

Matthew Rollings · CVE-2025-15386 · Published 2026-02-24 · Updated 2026-03-01

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Responsive Lightbox & Gallery WordPress plugin versions prior to 2.6.1

Description The software contains a flaw in its regex replacement rules that allows for an Unauthenticated Stored-XSS attack. This occurs when a malicious link is posted as a comment, and then approved with lightbox for comments enabled. The issue allows an attacker to inject malicious code that will be executed when other users view the comment.

Recommendations Update to version 2.6.1 or later.

Exploit

Fix

Related Identifiers

CVE-2025-15386

Affected Products

Responsive Lightbox & Gallery

References · 8

• 🔥 https://wpscan.com/vulnerability/fa3a84b6-6d5d-4e10-8587-ae49c127483b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15386 · Security Note
• https://twitter.com/VulmonFeeds/status/2026253689392869473 · Twitter Post
• https://twitter.com/cracbot/status/2027700470014480786 · Twitter Post
• https://twitter.com/cracbot/status/2028062781254381933 · Twitter Post
• https://twitter.com/CVEnew/status/2026184592668172588 · Twitter Post
• https://t.me/CVEtracker/45577 · Telegram Post
• https://twitter.com/TheHackerWire/status/2026351601527697919 · Twitter Post