Vulnerabilidades de dfactory Responsive Lightbox & Gallery (CVE)

Registros CVE publicados para dfactory Responsive Lightbox & Gallery, los más recientes primero. Siga el producto para recibir un correo con cada nueva.

7 resultados

4.4Media

CVE-2026-103897 hace 1 mes

Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute

dfactory Responsive Lightbox & Gallery

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for …

5.0Media

CVE-2026-2479 hace 8 meses

Responsive Lightbox & Gallery <= 2.7.1 - Authenticated (Author+) Server-Side Request Forgery via Remote Library Image Upload

dfactory Responsive Lightbox & Gallery

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.1. This is due to the use of `strpos()` for substring-based hostname validation instead of strict host comparison in …

5.4Media

CVE-2025-12359 hace 12 meses

Responsive Lightbox & Gallery <= 2.5.3 - Authenticated (Author+) Server-Side Request Forgery

dfactory Responsive Lightbox & Gallery

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.3 via the 'get_image_size_by_url' function. This is due to insufficient validation of user-supplied URLs when determi…

6.4Media

CVE-2024-5667 hace 1 año

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Library

cipherdevgroup WP Featherlight – A Simple jQuery Lightbox; dfactory Responsive Lightbox & Gallery

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Featherlight.js JavaScript library (versions 1.7.13 to 1.7.14) in various versions due to insufficient input sanitization and output escaping on user supplie…

6.4Media

CVE-2024-5020 hace 1 año

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library

extendthemes Colibri Page Builder; smub Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More; bqworks Accordion Slider; 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attribu…

6.4Media

CVE-2024-6870 hace 2 años

Responsive Lightbox & Gallery <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload

dfactory Responsive Lightbox & Gallery

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping affecting the rl_upload_image AJAX endp…

5.9Media

CVE-2023-49174 hace 2 años

WordPress Responsive Lightbox Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)

dFactory Responsive Lightbox & Gallery

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox & Gallery allows Stored XSS.This issue affects Responsive Lightbox & Gallery: from n/a through 2.4.5.