The Responsive Lightbox & Gallery WordPress plugin is vulnerable to unauthenticated Stored XSS, allowing remote attackers to execute arbitrary scripts in the context of an administrator session.

This is a Stored Cross-Site Scripting (XSS) vulnerability occurring when lightbox functionality is enabled for comments. An unauthenticated attacker can trigger this flaw by submitting a comment containing a specifically crafted malicious link that bypasses existing regex replacement rules.

Successful exploitation allows an attacker to execute arbitrary JavaScript within the browser of a victim, typically an administrator. Given the CVSS score of 8.8, this poses a high risk of account takeover, unauthorized administrative actions, and potential site-wide compromise, which could lead to significant operational downtime or data exfiltration.

Immediate Action: Update the Responsive Lightbox & Gallery plugin to version 2.6.1 or later immediately.

Proactive Monitoring: Monitor site comment sections for suspicious links or unusual characters and review administrative logs for unauthorized changes occurring after comment moderation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common XSS patterns in comment fields until the plugin can be updated.

Public Exploit Available: Unknown.

This vulnerability presents a high risk to WordPress installations due to the ease with which an unauthenticated attacker can inject persistent malicious scripts. Administrators must prioritize updating to version 2.6.1 or later to fully remediate the flaw. If an update is not immediately feasible, consider disabling the lightbox for comments feature to mitigate the attack vector.