CVE-2026-103897

Name of the Vulnerable Software and Affected Versions Responsive Lightbox & Gallery versions prior to 2.8.0

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with editor-level access or higher can inject arbitrary web scripts via the comment parameter. These scripts execute when a user accesses the affected page, provided the 'Comments' lightbox setting is enabled, a moderator approves the comment, and a visitor clicks the image to open the lightbox.

Recommendations Update to a version newer than 2.7.9. Disable the 'Comments' lightbox setting to prevent exploitation.