Description
The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious link when lightbox for comments are enabled and then approved.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Responsive Lightbox & Gallery | 1.7.0 – < 2.6.1 | 2.6.1 |
References
- https://wpscan.com/vulnerability/fa3a84b6-6d5d-4e10-8587-ae49c127483b/ exploit vdb-entry technical-description