CVE-2025-15386: 
WordPress vulnerability analysis and mitigation

CVE-2025-15386 is an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the Responsive Lightbox & Gallery WordPress plugin affecting all versions before 2.6.1. The flaw stems from flawed regex replacement rules that fail to properly sanitize user-supplied input in comments when the lightbox for comments feature is enabled. It was publicly disclosed on February 3, 2026, and assigned a CVSS v3.1 base score of 8.8 (High) (WPScan, Red Hat). The vulnerability was discovered and reported by researcher Matthew Rollings (stealthcopter) (WPScan).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting) and arises from defective regex replacement logic in the plugin's comment processing code (WPScan). When the "Enable lightbox for comments content" setting is active, the plugin processes hyperlinks in comments using flawed regex rules that can be bypassed by crafting a malicious link payload. An unauthenticated attacker submits a comment containing the malicious link; once an administrator approves the comment, the injected JavaScript executes in the browsers of any user who views the comment. No authentication or elevated privileges are required to submit the payload, though admin approval of the comment is a prerequisite for execution (WPScan, Red Hat).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of any user viewing the affected comment, including administrators. This can lead to session hijacking, credential theft, account takeover, malware distribution, or website defacement. Given that administrators may view comments in the WordPress dashboard, exploitation could result in complete compromise of the WordPress site's administrative access and integrity (WPScan, Red Hat).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation at this time (Red Hat). The vulnerability has an EPSS score of approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It has been detected by Qualys (detection ID 530998) and is included in Qualys's March 2026 application security detections (Red Hat).

1. Reconnaissance: Identify WordPress sites running the Responsive Lightbox & Gallery plugin in a version prior to 2.6.1, and confirm that the "Enable lightbox for comments content" setting is active (visible in plugin settings at /wp-admin/admin.php?page=responsive-lightbox-settings).
2. Craft malicious comment: As an unauthenticated user, navigate to any post or page on the target site that allows comments.
3. Submit payload: Post a comment containing a crafted hyperlink that embeds a malicious JavaScript payload exploiting the flawed regex replacement rules (e.g., a link tag with an onerror or onmouseover attribute containing JavaScript).
4. Wait for approval: The comment must be approved by an administrator. Social engineering or targeting sites with auto-approval enabled can reduce this dependency.
5. Trigger execution: Once approved, any user (including administrators) who views the comment page will have the injected JavaScript execute in their browser, enabling session cookie theft, credential harvesting, or further malicious actions (WPScan).

• Logs: WordPress comment logs or database entries containing unusual HTML/JavaScript within comment fields, particularly <script> tags, onerror, onmouseover, or other event handler attributes embedded in hyperlinks.
• Network: Outbound requests from user browsers to unexpected external domains shortly after loading pages with comments (indicative of data exfiltration or beacon callbacks from injected scripts).
• File System: No direct file system artifacts expected, as the payload is stored in the WordPress database (wp_comments table); review comment content in the database for suspicious link structures.
• Logs: Web server access logs showing POST requests to comment submission endpoints (wp-comments-post.php) with unusually long or encoded comment body parameters from unauthenticated (no session cookie) sources.

The vendor has released version 2.6.1 of the Responsive Lightbox & Gallery plugin, which fixes the flawed regex replacement rules. Site administrators should immediately update the plugin to version 2.6.1 or later via the WordPress plugin dashboard (WPScan). If an immediate upgrade is not possible, disabling the "Enable lightbox for comments content" feature in the plugin settings eliminates the attack surface. Additionally, administrators should review and remove any suspicious comments submitted before the patch was applied, and consider implementing a Content Security Policy (CSP) to limit the impact of any XSS attacks.

The vulnerability was shared on social media platforms including Mastodon and Bluesky by security news accounts such as The Hacker Wire, indicating moderate community awareness (Red Hat). The Spanish national cybersecurity agency INCIBE published an alert for the vulnerability. Qualys included it in their March 2026 application security detections bulletin. No major vendor statements or significant researcher controversy beyond the original disclosure by Matthew Rollings have been noted.