CVE-2026-103897: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in dfactory Responsive Lightbox & Gallery

CVE-2026-103897 is a stored cross-site scripting vulnerability in the Responsive Lightbox & Gallery WordPress plugin affecting all versions up to and including 2.7.9. The flaw arises from insufficient sanitization and escaping of the 'comment' parameter, enabling authenticated users with editor or higher privileges to inject arbitrary web scripts. Exploitation requires the 'Comments' lightbox feature to be enabled (disabled by default), approval of the malicious comment by a moderator, and a site visitor to interact with the injected content by clicking the affected image, triggering script execution.

An attacker with editor-level or higher access can inject persistent malicious scripts that execute in the context of site visitors who interact with the affected lightbox images. This can lead to limited confidentiality and integrity impacts such as session hijacking or content manipulation. The vulnerability does not allow unauthenticated exploitation and requires multiple conditions, reducing the overall risk.

No official patch or fix is currently available. Mitigation involves disabling the 'Comments' lightbox setting, which is disabled by default, and restricting editor-level access to trusted users. Site administrators should monitor and moderate comments carefully to prevent approval of malicious content. Check the vendor advisory for updates on patches or official fixes.