Executive brief
Responsive Lightbox is a popular WordPress plugin used to display images and galleries in a professional overlay window. A security vulnerability allows attackers to inject malicious scripts into the website, which could lead to unauthorized actions being performed in the browser of a visiting user. This could result in the theft of session information or the defacement of the site for specific visitors.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the dFactory Responsive Lightbox plugin for WordPress (versions <= 2.7.6) due to improper neutralization of user-supplied input during web page generation (CWE-79). An unauthenticated remote attacker can exploit this by tricking a user into clicking a specially crafted link. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or unauthorized administrative actions if the victim is an authenticated administrator. The issue is addressed in version 2.7.7.
Affected products
- dFactory Responsive Lightbox <= 2.7.6
Timeline
- 2026-06-26: disclosed
- 2026-06-26: advisory