CVE-2025-5093 describes a Stored Cross-Site Scripting (XSS) vulnerability in the Responsive Lightbox & Gallery WordPress plugin, specifically affecting versions prior to 2.5.2. The flaw stems from the Swipebox library's failure to properly validate and escape title attributes, allowing authenticated users with contributor roles or higher to inject malicious scripts into pages or posts. Rated as Medium severity with a CVSS score of 5.4, this vulnerability requires user interaction (UI:R) and low privileges (PR:L) for exploitation, potentially leading to limited impact on confidentiality and integrity (C:L, I:L). The attack complexity is low (AC:L), but the scope is changed (S:C), indicating the attack can affect resources beyond the immediate vulnerability. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness or attention at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.5.2CPE matchmatch criteria | cpe:2.3:a:dfactory:responsive_lightbox:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.