IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
5.4Mittel

CVE-2025-5093Responsive Lightbox & Gallery < 2.5.2 - Contributor+ Stored XSS

Responsive Lightbox & Gallery Veröffentlicht: (vor 1 Jahr)

Beschreibung

The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Schwachstellentyp (CWE): CWE-79

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
dfactory responsive lightbox < 2.5.2
— Responsive Lightbox & Gallery < 2.5.2

Referenzen und Patches

CPE-Treffer (NVD) (1)
  • cpe:2.3:a:dfactory:responsive_lightbox:*:*:*:*:*:wordpress:*:* < 2.5.2

Neue CVEs im selben Produkt — WordPress plugins & themes

7.2Hoch
CVE-2026-120687

Lightbox & Modal Popup WordPress Plugin <= 2.8.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Image Alt Attribute in .wp-caption Containers

fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox

The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute inside .wp-caption container' parameter in all versions up to, and including, 2.8.7 due to insufficient…

9.8Kritisch
CVE-2026-19907

Shipo 1.6 - 1.8.0 - Authentication Bypass to Administrator

shipo Shipo

The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the cookie's c…