Responsive Lightbox & Gallery < 2.5.2 – Contributor+ Stored XSS | CVE 2025-5093 | Plugin Vulnerabilities

Description

The plugin use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

1. Browse to `wp-admin/admin.php?page=responsive-lightbox-settings` and make sure the default lightbox is SwipeBox
2. As a contributor create a new post containing this HTML:

`<a title="&lt;img src=x onerror=&quot;alert()&quot;&gt;" href="https://www.youtube.com/watch?v=_aLoX-OgoX8">Click me</a>`

If another user clicks the link the JS is executed.

Affects Plugins

responsive-lightbox

Fixed in 2.5.2

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Pierre Rudloff

Submitter

Pierre Rudloff

Verified

Yes

WPVDB ID

1862b4a6-5570-48a4-9b09-f9659eb0e9e3

Timeline

Publicly Published

2025-06-06 (about 6 months ago)

Added

2025-06-06 (about 6 months ago)

Last Updated

2025-06-06 (about 6 months ago)

Other

Published

Title

Published

2024-08-16

Title

WP-Lister Lite for eBay < 3.6.1 - Reflected Cross-Site Scripting

Published

2024-03-06

Title

Booster for WooCommerce < 7.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde

Published

2023-05-22

Title

Custom Base Terms < 1.0.3 - Admin+ Stored XSS

Published

2022-12-02

Title

ImageInject <= 1.17 - Admin+ Stored XSS

Published

2025-04-04

Title

Ni WooCommerce Cost Of Goods < 3.2.9 - Subscriber+ Stored XSS