{"id":"CVE-2025-9710","aliases":["EUVD-2025-32143","GHSA-855p-w5cf-52rp"],"status":"published","title":"Responsive Lightbox \u0026 Gallery \u003c 2.5.3 - Unauthenticated Stored-XSS via Comments","description":"The Responsive Lightbox \u0026 Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00214,"percentile":0.11811,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2025-10-06T06:00:06Z","modified":"2026-10-09T10:10:00Z","products":[{"vendor":"unknown","product":"responsive lightbox \u0026 gallery"}],"references":[{"url":"https://wpscan.com/vulnerability/a45c74b7-b174-479f-9681-464601b082df/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9710"},{"url":"https://wpscan.com/vulnerability/a45c74b7-b174-479f-9681-464601b082df"},{"url":"https://github.com/advisories/GHSA-855p-w5cf-52rp"}],"sources":{"cve":[{"id":"CVE-2025-9710","title":"Responsive Lightbox \u0026 Gallery \u003c 2.5.3 - Unauthenticated Stored-XSS via Comments","description":"The Responsive Lightbox \u0026 Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.","status":"published","published":"2025-10-06T06:00:06.607Z","modified":"2025-10-06T18:50:04.946Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:32:34.096798Z"}],"euvd":[{"id":"EUVD-2025-32143","description":"The Responsive Lightbox \u0026 Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.","status":"published","published":"2025-10-06T06:00:06Z","modified":"2025-10-06T18:50:04Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:31:35.828093Z"}],"ghsa":[{"id":"GHSA-855p-w5cf-52rp","title":"The Responsive Lightbox \u0026 Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag...","description":"The Responsive Lightbox \u0026 Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.","status":"published","published":"2025-10-06T06:32:58Z","modified":"2025-10-06T21:31:51Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:03:52.40546Z"}],"nvd":[{"id":"CVE-2025-9710","description":"The Responsive Lightbox \u0026 Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.","status":"published","published":"2025-10-06T06:15:37.467Z","modified":"2026-10-09T10:10:00.193Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:11:35.93863Z"}]}}