CVE-2025-5093

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Responsive Lightbox & Gallery	< 2.5.2

References

https://wpscan.com/vulnerability/1862b4a6-5570-48a4-9b09-f9659eb0e9e3/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/1862b4a6-5570-48a4-9b09-f9659eb0e9e3/Exploit, Third Party Advisory

Timeline

Published: Jun 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-509386.1Cross site scripting (XSS) vulnerability in Hustoj 2025-01-31 via the TID parameter to thread.php.CVE-2025-509448.8An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0. The custom X5 CVE-2025-509466.5OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.CVE-2025-509496.5FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8.CVE-2025-50959.8Burk Technology ARC Solo's password change mechanism can be utilized without proper authentication procedures, allowing an attacker to take CVE-2025-509507.5Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function.CVE-2025-509516.5FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.CVE-2025-509526.5openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c.CVE-2025-50965.4The TablePress plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the 'data-caption', 'data-s-content-padding',CVE-2025-509717.5Directory traversal vulnerability in AbanteCart version 1.4.2 allows unauthenticated attackers to gain access to sensitive system files via CVE-2025-509729.8SQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to execute arbitrary SQL commands via the tmpl_id paramete CVE-2025-509746.5The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied input before incorp