Dfactory Responsive Lightbox vulnerabilities
9 vulnerabilities
Known vulnerabilities in Dfactory Responsive Lightbox, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-5093dfactoryresponsive_lightbox+2
EPSS score0.23%
The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.CVE-2025-3742dfactoryresponsive_lightbox+2EPSS score0.54%
The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.CVE-2017-2243dfactoryresponsive_lightbox+1EPSS score1.45%
Cross-site scripting vulnerability in Responsive Lightbox prior to version 1.7.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.CVE-2024-31252dfactoryresponsive_lightbox+2EPSS score0.36%
Missing Authorization vulnerability in dFactory Responsive Lightbox.This issue affects Responsive Lightbox: from n/a through 2.4.6.CVE-2024-43924dfactoryresponsive_lightbox+1EPSS score0.53%
Missing Authorization vulnerability in dFactory Responsive Lightbox allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Responsive Lightbox: from n/a through 2.4.7.CVE-2024-49282dfactoryresponsive_lightbox+1EPSS score0.27%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox responsive-lightbox allows Stored XSS.This issue affects Responsive Lightbox: from n/a through <= 2.4.8.CVE-2024-6870dfactoryresponsive_lightbox+2EPSS score0.33%
The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping affecting the rl_upload_image AJAX endpoint. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the 3gp2 file.CVE-2026-56041dfactoryresponsive_lightbox+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions.CVE-2023-49174dfactoryresponsive_lightbox+2EPSS score0.38%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox & Gallery allows Stored XSS.This issue affects Responsive Lightbox & Gallery: from n/a through 2.4.5.