CVE-2025-5092

Name of the Vulnerable Software and Affected Versions WordPress plugins and themes versions prior to lightGallery 2.8.4

Description The software contains a Stored Cross-Site Scripting issue due to insufficient input sanitization and output escaping on user-supplied attributes within the lightGallery library. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

Recommendations Update the lightGallery library to version 2.8.4 or later.