CVE-2026-56041

HighCVSS 7.1

Published: 26/06/2026(UTC)Updated: 29/06/2026(UTC)Translated: 30/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile — higher than 8% of all known CVEs

Summary

The Responsive Lightbox plugin version 2.7.6 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.

Risk Assessment

The risk involves the execution of arbitrary scripts in the victim's browser, potentially leading to session theft, redirects to malicious sites, or theft of sensitive data.

Recommendation

It is recommended to immediately update the Responsive Lightbox plugin to the latest available version that fixes this vulnerability.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions.