Responsive Lightbox & Gallery EUVD-2026-96219

Exploitation requires a chain of specific, non-default prerequisites: (1) the plugin's 'Comments' lightbox setting must be explicitly enabled (it is disabled by default); (2) the attacker must authenticate with editor-level privileges or higher (PR:H); (3) a moderator must manually approve the injected comment; and (4) a site visitor must click the affected image to open the lightbox before the stored payload executes. These stacked limiting factors - non-default configuration, high-privilege authenticated access, human moderation, and required visitor interaction - substantially constrain realistic exploitation beyond what the raw network vector suggests.

This is a genuinely low-priority issue despite being a 'network' vector XSS. The official CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N = 4.4 Medium) already encodes heavy preconditions: PR:H confirms the attacker must hold an authenticated editor-level-or-above account, and AC:H reflects the stacked conditions (a non-default plugin setting must be enabled, a moderator must approve the comment, and a visitor must interact). No EPSS score, CISA KEV entry, or public POC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' All signals align rather than conflict - low CVSS, no exploitation evidence, high attacker privilege, and a narrow default-disabled trigger path all point the same direction. One discrepancy worth flagging: the official vector sets UI:N, yet the description explicitly requires a site visitor to click the affected image to open the lightbox, which is genuine victim interaction - this suggests the real-world barrier is slightly higher than the published vector implies. Net assessment: a defense-in-depth fix, not an emergency; a malicious or compromised editor is already a high-trust insider.

A WordPress site has the Responsive Lightbox & Gallery plugin's non-default 'Comments' lightbox feature enabled. An attacker who already holds an editor-level account submits a comment containing a crafted script in the 'comment' parameter; a moderator approves it, and the payload then executes in the browser of any visitor who clicks the associated image to open the lightbox. No public exploit code is identified at time of analysis.