EUVD-2026-39703
GHSA-q229-6rqj-ph5c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network XSS (AV:N/PR:N) needing a victim click (UI:R) with browser-context scope change (S:C); low C/I, no real availability impact so A:N.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions.
AnalysisAI
Cross-site scripting in the Responsive Lightbox WordPress plugin (versions up to and including 2.7.6) lets unauthenticated remote attackers inject script that executes in a victim's browser when they interact with a crafted link or page. The CVSS 3.1 score of 7.1 reflects a scope-changing reflected/stored XSS (UI:R) that can run in the context of any visitor or logged-in administrator. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires no authentication (PR:N) but does require victim user interaction (UI:R) - the target must open an attacker-supplied link or visit a page carrying the malicious payload, so it cannot fire fully automatically without a lured victim. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) describes a low-complexity, network-reachable, unauthenticated attack whose main limiting factor is required user interaction (UI:R) - a victim must open a malicious link or page. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL or page containing a malicious script payload aimed at the vulnerable Responsive Lightbox parameter and sends it to a site visitor or administrator (e.g., via email, comment, or another site). When the victim opens the link, the script executes in their browser session against the WordPress site, enabling session/cookie theft or actions performed as that user. … |
| Remediation | No vendor-released patch version was identified in the available data, so the specific upgrade target cannot be cited; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/responsive-lightbox/vulnerability/wordpress-responsive-lightbox-plugin-2-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WordPress plugin repository for any release above 2.7.6 and update to it as the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WordPress installations using Responsive Lightbox and confirm current plugin version. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today