CVE-2025-5092

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
lightgalleryteam	LightGallery WP	<= 1.0.5
tplugins	TP WooCommerce Product Gallery	<= 1.1.9
vowelweb	Ibtana – WordPress Website Builder	<= 1.2.5.1
wproyal	Royal Addons for Elementor – Addons and Templates Kit for Elementor	<= 1.7.1031
wpsofts	Portfolio, Gallery, Product Catalog – Grid KIT Portfolio	<= 2.2.1
famethemes	OnePress	<= 2.3.16
galaxyweblinks	Gallery with thumbnail slider	<= 7.8
oxilab	Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )	<= 9.10.5

References

Timeline

Published: Nov 20, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-509266.5Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the List All Emai CVE-2025-509276.3A reflected cross-site scripting (XSS) vulnerability in the List All FTP User Function in EHCP v20.04.1.b allows authenticated attackers to CVE-2025-509284.8Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the Change Settin CVE-2025-50935.4The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes CVE-2025-509386.1Cross site scripting (XSS) vulnerability in Hustoj 2025-01-31 via the TID parameter to thread.php.CVE-2025-509448.8An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0. The custom X5 CVE-2025-509466.5OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.CVE-2025-509496.5FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8.CVE-2025-50959.8Burk Technology ARC Solo's password change mechanism can be utilized without proper authentication procedures, allowing an attacker to take CVE-2025-509507.5Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function.CVE-2025-509516.5FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.CVE-2025-509526.5openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c.