CVE-2025-15386

High · 8.8

CVSS

8.8

EPSS

0.3%

Published

Feb 24, 2026

CISA due date

—

The record

The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious link when lightbox for comments are enabled and then approved.

Affected packages

Ecosystem	Package	Introduced	Fixed