CVE-2025-15386Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious link when lightbox for comments are enabled and then approved.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/fa3a84b6-6d5d-4e10-8587-ae49c127483b/

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

5 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 5 signals
Disclosure: 5 classified signals
Peaked 2d ago at 3 mentions (2026-02-24); latest day: 1
5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d

Signal classification1 categories

Disclosure

5100.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-24	3	Disclosure3
2026-02-28	1	Disclosure1
2026-03-01	1	Disclosure1

Full discourse5 posts

CRAC Learning - Tech@cracbot221d
Disclosure
CVE-2025-15386 (CVSS:8.8, HIGH) is Awaiting Analysis. The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack du..https://nvd.nist.gov/vuln/detail/CVE-2025-15386 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2025-15386, a high‑severity unauthenticated stored‑XSS vulnerability in the Responsive Lightbox & Gallery WordPress plugin before version 2.6.1, with no PoC, exploit, or patch details provided.
0000080
173 followersView on X
CRAC Learning - Tech@cracbot222d
Disclosure
CVE-2025-15386 (CVSS:8.8, HIGH) is Awaiting Analysis. The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack du..https://nvd.nist.gov/vuln/detail/CVE-2025-15386 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2025-15386, a high‑severity unauthenticated stored XSS flaw in Responsive Lightbox & Gallery WordPress plugin before 2.6.1, but offers no proof of concept, exploit code, or patch details.
0000092
173 followersView on X
The Hacker Wire@TheHackerWire226d
Disclosure
🟠 CVE-2025-15386 - High The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a com... https://www.thehackerwire.com/vulnerability/CVE-2025-15386/ https://t.co/wmagIkD6Ry
Post summary
The Responsive Lightbox & Gallery WordPress plugin (versions before 2.6.1) is vulnerable to unauthenticated stored‑XSS due to flawed regex replacement rules, as detailed in the linked vulnerability report.
0000053
113 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds226d
Disclosure
CVE-2025-15386 Unauthenticated Stored XSS in Responsive Lightbox & Gallery WordPress Pl... https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-15386 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The post announces CVE-2025-15386, an unauthenticated stored XSS vulnerability in the Responsive Lightbox & Gallery WordPress plugin, and provides links to detailed vulnerability information and a notification.
0000039
4.0K followersView on X
CVE@CVEnew227d
Disclosure
CVE-2025-15386 The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can b… https://www.cve.org/CVERecord?id=CVE-2025-15386
Post summary
The Responsive Lightbox & Gallery WordPress plugin versions prior to 2.6.1 are vulnerable to an unauthenticated stored‑XSS attack caused by flawed regex replacement rules.
0000068
56.5K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2025-15386

CRAC Learning - Tech@cracbotDisclosure

The post announces CVE-2025-15386, a high‑severity unauthenticated stored‑XSS vulnerability in the Responsive Lightbox & Gallery WordPress plugin before version 2.6.1, with no PoC, exploit, or patch details provided.

CRAC Learning - Tech@cracbotDisclosure

The post announces CVE-2025-15386, a high‑severity unauthenticated stored XSS flaw in Responsive Lightbox & Gallery WordPress plugin before 2.6.1, but offers no proof of concept, exploit code, or patch details.

The Hacker Wire@TheHackerWireDisclosure

The Responsive Lightbox & Gallery WordPress plugin (versions before 2.6.1) is vulnerable to unauthenticated stored‑XSS due to flawed regex replacement rules, as detailed in the linked vulnerability report.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces CVE-2025-15386, an unauthenticated stored XSS vulnerability in the Responsive Lightbox & Gallery WordPress plugin, and provides links to detailed vulnerability information and a notification.

CVE@CVEnewDisclosure

The Responsive Lightbox & Gallery WordPress plugin versions prior to 2.6.1 are vulnerable to an unauthenticated stored‑XSS attack caused by flawed regex replacement rules.