Responsive Lightbox & Gallery < 2.5.1 – Contributor+ Stored XSS | CVE 2025-3742 | Plugin Vulnerabilities

Description

The plugin does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

1. Browse to /wp-admin/admin.php?page=responsive-lightbox-settings and set "Default lightbox" to "prettyPhoto".
2. As a contributor create a new post containing this HTML:

`<a data-rl_caption="&lt;img src=x onerror=&quot;alert()&quot;&gt;" href="https://upload.wikimedia.org/wikipedia/commons/4/4b/Rufous_Breasted_Accentor_Male.jpg">Click me</a>`

3. If another user clicks the link while previewing the post, the malicious JS is executed.

Affects Plugins

responsive-lightbox

Fixed in 2.5.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Pierre Rudloff

Submitter

Pierre Rudloff

Verified

Yes

WPVDB ID

5b8f487b-63a5-4d2a-9b61-ed4d97f18320

Timeline

Publicly Published

2025-04-24 (about 7 months ago)

Added

2025-04-24 (about 7 months ago)

Last Updated

2025-04-24 (about 7 months ago)

Other

Published

Title

Published

2024-04-22

Title

Royal Elementor Addons and Templates < 1.3.972 - Contributor+ Stored Cross-Site Scripting via HTML Tags

Published

2021-11-15

Title

NEX-Forms < 8.4.3 - Stored Cross-Site Scripting via CSRF

Published

2017-06-01

Title

WP Live Chat Support < 7.0.07 - Cross-Site Scripting (XSS)

Published

2023-08-18

Title

Stock Sync for WooCommerce < 2.4.1 - Reflected XSS

Published

2021-12-14

Title

WooCommerce EnvioPack <= 1.2 - Reflected Cross-Site Scripting