Read the docs

dFactory

Records22All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

dFactory records in CISA KEV

No dFactory vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Responsive Lightbox 6 records HIGH Download Attachments 1 record LOW Post Views Counter 1 record LOW Responsive Lightbox & Gallery 1 record LOW

Records

6 records in Responsive Lightbox · all components

TI-2025-03296 CVE-2025-3742 · GHSA-m4qv-7jq9-f554

Responsive Lightbox & Gallery < 2.5.1 - Contributor+ Stored XSS

Priority HIGH 65

The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00541 Published 2025-05-15 Fixed in 2.5.1 CWE-79
TI-2025-04567 CVE-2025-5093 · GHSA-vpc7-8x7g-73gx

Responsive Lightbox & Gallery < 2.5.2 - Contributor+ Stored XSS

Priority MEDIUM 58

The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00234 Published 2025-06-27 Fixed in 2.5.2 CWE-79
TI-2017-01533 CVE-2017-2243 · GHSA-qvcv-mv2q-hpwq

Cross-site scripting in dFactory Responsive Lightbox

Priority LOW 30

Cross-site scripting vulnerability in Responsive Lightbox prior to version 1.7.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0145 Published 2017-07-07 No fix listed CWE-79
TI-2024-06371 CVE-2024-6870 · GHSA-455v-j4c3-4fqr

Responsive Lightbox & Gallery <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload

Priority LOW 28

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00329 Published 2024-08-22 No fix listed CWE-79
TI-2023-26833 CVE-2023-49174 · GHSA-rxg3-j9p8-7h3x

WordPress Responsive Lightbox Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox & Gallery allows Stored XSS.This issue affects Responsive Lightbox & Gallery: from n/a th…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00382 Published 2023-12-15 No fix listed CWE-79
Open these records in search →