What is the CVSS score of CVE-2026-56041?

CVE-2026-56041 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Responsive Lightbox are affected by CVE-2026-56041?

The Responsive Lightbox WordPress plugin (versions through 2.7.6) contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts affecting all website…

How to fix or mitigate CVE-2026-56041?

Within 24 hours: Identify all WordPress installations using Responsive Lightbox and confirm current plugin version. Within 7 days: Either disable the plugin entirely or implement web application firewall (WAF) rules to block XSS attempts; contact the plugin vendor to request patch status and timeline. Within 30 days: Migrate to an alternative lightbox plugin with confirmed security updates, or implement compensating controls if plugin remains business-critical.

Responsive Lightbox CVE-2026-56041

EUVD-2026-39703 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-q229-6rqj-ph5c

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network XSS (AV:N/PR:N) needing a victim click (UI:R) with browser-context scope change (S:C); low C/I, no real availability impact so A:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:02 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions.

AnalysisAI

Cross-site scripting in the Responsive Lightbox WordPress plugin (versions up to and including 2.7.6) lets unauthenticated remote attackers inject script that executes in a victim's browser when they interact with a crafted link or page. The CVSS 3.1 score of 7.1 reflects a scope-changing reflected/stored XSS (UI:R) that can run in the context of any visitor or logged-in administrator. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Responsive Lightbox is a WordPress plugin (by dFactory) that displays images, galleries and content in responsive lightbox overlays. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected or stored into HTML output without proper output encoding or input sanitization. Because the vector is unauthenticated (PR:N) the injection point is reachable on a public-facing request handler - typically a plugin parameter, shortcode attribute, or AJAX/REST endpoint that echoes attacker data back into a page. EUVD records the affected component as 'Responsive Lightbox n/a ≤2.7.6'; no precise CPE 2.3 string was provided in the source data.

RemediationAI

No vendor-released patch version was identified in the available data, so the specific upgrade target cannot be cited; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/responsive-lightbox/vulnerability/wordpress-responsive-lightbox-plugin-2-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WordPress plugin repository for any release above 2.7.6 and update to it as the primary fix. As compensating controls until a patched version is confirmed: deploy a WordPress-aware WAF / virtual patch (Patchstack or equivalent) to filter XSS payloads against the plugin's endpoints - this can break legitimate requests that contain HTML-like characters; restrict or disable the specific lightbox feature/shortcode that accepts external input if it is not essential, at the cost of losing that gallery functionality; and add a restrictive Content-Security-Policy (script-src without 'unsafe-inline') to reduce the impact of injected scripts, noting it may interfere with inline scripts used by other plugins/themes.