https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T03:05:16.577054+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-5092 CVE-2025-5092 — Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting… 2026-10-07T03:05:16.593403+00:00

Affected: lightgalleryteam LightGallery WP, tplugins TP WooCommerce Product Gallery, vowelweb Ibtana – WordPress Website Builder, wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor, wpsofts Portfolio, Gallery, Product Catalog – Grid KIT Portfolio, famethemes OnePress, galaxyweblinks Gallery with thumbnail slider, oxilab Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )

Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.