CVE-2025-9710 Responsive Lightbox & Gallery < 2.5.3 - Unauthenticated Stored-XSS via Comments
Unauthenticated attackers can inject malicious scripts via comments in the Responsive Lightbox & Gallery plugin, leading to stored XSS attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-9710?
CVE-2025-9710 is a medium-severity cross-site scripting vulnerability in Unknown Responsive Lightbox & Gallery, published on 6 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.
Which versions are affected by CVE-2025-9710?
How do I fix CVE-2025-9710?
No fix has been published for CVE-2025-9710 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-9710 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-9710 exists.
Sources
Also known as GHSA-855p-w5cf-52rp.