CVE-2025-5092

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5092", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-22T16:48:25.802Z", "datePublished": "2025-11-20T06:38:41.693Z", "dateUpdated": "2026-04-08T17:14:57.172Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:57.172Z"}, "affected": [{"vendor": "lightgalleryteam", "product": "LightGallery WP", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.5", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "tplugins", "product": "TP WooCommerce Product Gallery", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.9", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "vowelweb", "product": "Ibtana \u2013 WordPress Website Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.5.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "wproyal", "product": "Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.7.1031", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "wpsofts", "product": "Portfolio, Gallery, Product Catalog \u2013 Grid KIT Portfolio", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "famethemes", "product": "OnePress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.3.16", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "galaxyweblinks", "product": "Gallery with thumbnail slider", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.8", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "oxilab", "product": "Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "9.10.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/acaa3142-2bbc-43d3-8ecc-05e8edb931ec?source=cve"}, {"url": "https://github.com/sachinchoolur/lightGallery"}, {"url": "https://plugins.trac.wordpress.org/changeset/3311382/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3356089/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3372141/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3343557/"}, {"url": "https://themes.trac.wordpress.org/changeset/299860"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "timeline": [{"time": "2025-06-11T08:22:48.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-19T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-20T15:43:06.923714Z", "id": "CVE-2025-5092", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-20T15:43:12.710Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5092", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-20T15:43:06.923714Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-20T15:43:09.730Z"}}], "cna": {"title": "Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library", "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "lightgalleryteam", "product": "LightGallery WP", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.5"}], "defaultStatus": "unaffected"}, {"vendor": "tplugins", "product": "TP WooCommerce Product Gallery", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.9"}], "defaultStatus": "unaffected"}, {"vendor": "vowelweb", "product": "Ibtana \u2013 WordPress Website Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.5.1"}], "defaultStatus": "unaffected"}, {"vendor": "wproyal", "product": "Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.7.1031"}], "defaultStatus": "unaffected"}, {"vendor": "wpsofts", "product": "Portfolio, Gallery, Product Catalog \u2013 Grid KIT Portfolio", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2.1"}], "defaultStatus": "unaffected"}, {"vendor": "famethemes", "product": "OnePress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.3.16"}], "defaultStatus": "unaffected"}, {"vendor": "galaxyweblinks", "product": "Gallery with thumbnail slider", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.8"}], "defaultStatus": "unaffected"}, {"vendor": "oxilab", "product": "Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "9.10.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-11T08:22:48.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-19T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/acaa3142-2bbc-43d3-8ecc-05e8edb931ec?source=cve"}, {"url": "https://github.com/sachinchoolur/lightGallery"}, {"url": "https://plugins.trac.wordpress.org/changeset/3311382/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3356089/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3372141/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3343557/"}, {"url": "https://themes.trac.wordpress.org/changeset/299860"}], "descriptions": [{"lang": "en", "value": "Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:57.172Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5092", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:14:57.172Z", "dateReserved": "2025-05-22T16:48:25.802Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-20T06:38:41.693Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "LightGallery WP", "vendor": "lightgalleryteam", "versions": [{"lessThanOrEqual": "1.0.5", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "TP WooCommerce Product Gallery", "vendor": "tplugins", "versions": [{"lessThanOrEqual": "1.1.9", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Ibtana \u2013 WordPress Website Builder", "vendor": "vowelweb", "versions": [{"lessThanOrEqual": "1.2.5.1", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor", "vendor": "wproyal", "versions": [{"lessThanOrEqual": "1.7.1031", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Portfolio, Gallery, Product Catalog \u2013 Grid KIT Portfolio", "vendor": "wpsofts", "versions": [{"lessThanOrEqual": "2.2.1", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "OnePress", "vendor": "famethemes", "versions": [{"lessThanOrEqual": "2.3.16", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Gallery with thumbnail slider", "vendor": "galaxyweblinks", "versions": [{"lessThanOrEqual": "7.8", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )", "vendor": "oxilab", "versions": [{"lessThanOrEqual": "9.10.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-5092", "lastModified": "2026-06-17T09:47:11.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5092", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-20T15:43:06.923714Z", "version": "2.0.3"}}]}, "published": "2025-11-20T15:17:37.650", "references": [{"source": "security@wordfence.com", "url": "https://github.com/sachinchoolur/lightGallery"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3311382/"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3343557/"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3356089/"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3372141/"}, {"source": "security@wordfence.com", "url": "https://themes.trac.wordpress.org/changeset/299860"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/acaa3142-2bbc-43d3-8ecc-05e8edb931ec?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:35:51.157137+00:00", "value": {"mitigation_remediation": ["Upgrade all affected themes and plugins to a version that removes or updates the lightGallery library beyond 2.8.3.", "If an update is not immediately available, delete or sanitize any stored gallery or image data that could contain malicious attributes, then reset or recreate gallery entries.", "Restrict Contributor role permissions to remove media upload or gallery editing capabilities until a patch is deployed."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross-Site Scripting that can execute injected scripts when users view affected pages"}, "threat_synthesis": {"affected_systems": "Any WordPress site that has one of the following plugins or themes installed and is using lightGallery 2.8.3 or older: OnePress, Gallery with thumbnail slider, LightGallery WP, Image Hover Effects Ultimate, TP WooCommerce Product Gallery, Ibtana \u2013 WordPress Website Builder, Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor, Portfolio, Gallery, Product Catalog \u2013 Grid KIT Portfolio. Precise version ranges are not listed; the issue exists in all releases that contain the vulnerable library.", "description_and_impact": "The vulnerability arises from the bundled lightGallery JavaScript library (version 2.8.3 or earlier) used by several WordPress plugins and themes. Insufficient sanitization of user\u2011supplied attributes allows an attacker who can authenticate as a Contributor or higher to store arbitrary JavaScript code in gallery or image metadata. When an affected page is viewed, the injected script runs in the context of the site, enabling content theft, session hijacking, or site defacement.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of observed exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session with Contributor or higher privileges; once injected, the malicious script will affect all users who view the page containing the stored payload. Active defenses such as a Content Security Policy could mitigate the impact, but no automated exploit has been reported."}}}}, "created": "2025-11-24T09:10:27.400349+00:00", "updated": "2026-04-20T21:45:18.963261+00:00", "vendors": ["famatehemes", "famatehemes$PRODUCT$onepress", "galaxyweblinks", "galaxyweblinks$PRODUCT$gallery_with_thumbnail_slider", "lightgalleryteam", "lightgalleryteam$PRODUCT$lightgallery_wp", "tplugins", "tplugins$PRODUCT$tp_woocommerce_product_gallery", "vowelweb", "vowelweb$PRODUCT$ibtana", "wordpress", "wordpress$PRODUCT$wordpress", "wpkin", "wpkin$PRODUCT$image_hover_effects_ultimate", "wproyal", "wproyal$PRODUCT$royal_elementor_addons_and_templates", "wpsofts", "wpsofts$PRODUCT$portfolio_gallery,_product_catalog_-_grid_kit_portfolio"]}