The dFactory Responsive Lightbox plugin versions up to 2.4.8 suffer from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers with high privileges and requiring user interaction to inject malicious scripts that can impact confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction needed, and a scope change with partial impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users, potentially leading to data disclosure, content manipulation, or denial of service. The impact is rated medium based on the CVSS score and the requirement for high privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit plugin usage to trusted users with appropriate privileges and monitor for suspicious activity related to script injection. Avoid exposing the plugin to untrusted users. Follow vendor communications for updates on patches or official mitigations.