Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library
medium
Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contrib...
- CVSS:
- 6.4
- Affected:
- up to 7.8
- Fix:
- No patched version reported
- Disclosed:
- Nov 19, 2025
CVE-2025-5092 on NVD →
Gallery with thumbnail slider <= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The Gallery with thumbnail slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.0 due to insufficient input sanitization and output escaping on the plugin's settings. This makes it possible for authenticated attackers, with contributor-level permissions and above,...
- CVSS:
- 6.4
- Affected:
- up to 6.0
- Fixed in:
- 6.1
- Disclosed:
- Oct 27, 2022
CVE-2022-42485 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database