This vulnerability involves improper input sanitization in the Lightbox slider – Responsive Lightbox Gallery plugin by Weblizar, leading to stored cross-site scripting (XSS). An attacker with low privileges can inject malicious scripts that are stored and later executed in the context of other users viewing the affected pages. The issue affects all versions up to 1.10.6. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users viewing affected pages, potentially leading to data disclosure, modification, or disruption of service. The vulnerability requires low privileges and user interaction, which somewhat limits exploitation scope. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider limiting plugin usage or applying temporary mitigations such as disabling the plugin or restricting access to affected functionality. Monitor official Weblizar communications for updates.