CVE-2026-103897 in Responsive Lightbox & Gallery Plugin
Summary
by MITRE • 10/10/2026
The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the plugin's 'Comments' lightbox setting to be enabled (disabled by default), a moderator to approve the injected comment, and a site visitor to click the affected image to open the lightbox.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The Responsive Lightbox & Gallery plugin for WordPress contains a stored cross-site scripting vulnerability affecting all versions up to 2.7.9. This security flaw stems from insufficient input sanitization and output escaping mechanisms within the application code, specifically when processing data submitted through the comment parameter. The nature of this vulnerability allows malicious actors with authenticated access at the editor level or higher to inject arbitrary web scripts into pages hosted on the target WordPress site. These injected scripts are stored in the database and execute whenever a user accesses an affected page that renders the compromised content.
Exploitation of this vulnerability requires specific conditions to be met within the targeted environment. First, the plugin's Comments lightbox setting must be enabled, as it is disabled by default in standard configurations. Second, the injected comment containing malicious script code must undergo and pass a moderation process, requiring approval from a site moderator or administrator with appropriate privileges. Finally, exploitation is triggered when an unsuspecting site visitor interacts with the content by clicking on the affected image to open the lightbox interface. Upon this interaction, the stored malicious payload executes within the context of the victim's browser session.
The operational impact of this vulnerability is significant due to its potential for widespread user compromise. Since the script execution occurs in the context of the legitimate website, attackers can perform actions such as stealing administrative credentials through cookie theft, hijacking user sessions, defacing websites, or redirecting users to malicious external sites. The requirement for moderator approval adds a layer of social engineering complexity but does not mitigate the severity once approved, as it ensures persistence and broader exposure to multiple visitors rather than just immediate exploitation by the attacker.
From an industry standards perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector corresponds to ATT&CK technique T1059, specifically subtechniques involving command and scripting interpreter execution through web browsers. Additionally, the requirement for authenticated access places this within the scope of privilege escalation scenarios where lower-level users leverage insufficient validation controls to achieve higher-impact outcomes such as data exfiltration or system manipulation.
Mitigation strategies should prioritize immediate updates to version 2.7.9 or later if available from the official plugin repository. In cases where updating is not immediately feasible, administrators can mitigate risk by disabling the Comments lightbox feature through the plugin settings until a patch is applied. Furthermore, implementing strict Content Security Policy headers can help restrict script execution sources and reduce the impact of successful injection attempts. Regular auditing of user inputs and ensuring that all dynamic content undergoes rigorous sanitization before storage and escaping before output are critical defensive measures against this class of vulnerabilities.