The vulnerability is an unauthenticated Cross‑Site Scripting flaw, identified as CWE‑79, that exists in the dFactory Responsive Lightbox WordPress plugin versions 2.7.6 and earlier. It permits any visitor to inject arbitrary JavaScript that is rendered when the lightbox is opened, allowing cookie theft, session hijacking, defacement or other malicious actions in the context of the site visitor. The flaw is caused by insufficient output encoding of user‑supplied data in the plugin’s lightbox rendering logic.

The dFactory Responsive Lightbox plugin for WordPress, versions 2.7.6 and previous releases, is affected. Upgrading to version 2.7.7 or newer removes the flaw; no other WordPress components or plugins are listed as impacted.

The CVSS score of 7.1 indicates a high severity risk, while the EPSS score is not available, so the exploitation probability cannot be quantified. The vulnerability is not catalogued in CISA’s KEV, suggesting no documented exploitation. However, because the attack is unauthenticated, any site visitor can trigger it, meaning the risk is significant for sites still running older plugin versions.