TLDRVuln - Cybersecurity Vulnerabilities Made Simple

CVE-2025-9710

Medium · published October 6, 2025

CVSS v3.1

6.3

EPSS

Percentile

11.1

In the wild

Unconfirmed

What it is

The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.

The record

Technical detail

CVSS v3.1: 6.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00214 · 11.1th percentile
Published: 2025-10-06T10:15Z

References (1)

https://wpscan.com/vulnerability/a45c74b7-b174-479f-9681-464601b082df/ · [email protected]

EPSS history

Timeline

06 OCT 06:00Z
Responsive Lightbox & Gallery < 2.5.3 - Unauthenticated Stored-XSS via Comments
cvelistv5