Responsive Lightbox (Dfactory) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 90 known versions, newest CVE from 2026-06-26. Vendor: Dfactory.

CVEs of Responsive Lightbox

• CVE-2026-56041 - CVSS 7.1 (high), 2026-06-26: Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions.
• CVE-2025-5093 - CVSS 5.4 (medium), 2025-06-27: The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting…
• CVE-2025-3742 - CVSS 6.8 (medium), 2025-05-15: The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a…
• CVE-2024-43924 - CVSS 9.8 (critical), 2024-10-23: Missing Authorization vulnerability in dFactory Responsive Lightbox allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects…
• CVE-2024-49282 - CVSS 5.9 (medium), 2024-10-17: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox responsive-lightbox allows…
• CVE-2024-6870 - CVSS 6.4 (medium), 2024-08-22: The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including,…
• CVE-2024-31252 - CVSS 8.8 (high), 2024-06-09: Missing Authorization vulnerability in dFactory Responsive Lightbox.This issue affects Responsive Lightbox: from n/a through 2.4.6.
• CVE-2023-49174 - CVSS 5.9 (medium), 2023-12-15: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox & Gallery allows Stored…
• CVE-2017-2243 - CVSS 6.1 (medium), 2017-07-07: Cross-site scripting vulnerability in Responsive Lightbox prior to version 1.7.2 allows an attacker to inject arbitrary web script or HTML via unspecified…