What’s Vulnerable › Products
dfactory Responsive Lightbox & Gallery vulnerabilities
15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.
Check whether your dfactory Responsive Lightbox & Gallery version is affected
Latest dfactory Responsive Lightbox & Gallery vulnerabilities
- CVE-2026-103897 — Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute (CVSS 4.4)
- CVE-2026-56041 — WordPress Responsive Lightbox plugin <= 2.7.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-2479 — Responsive Lightbox & Gallery <= 2.7.1 - Authenticated (Author+) Server-Side Request Forgery via Remote Library Image Upload (CVSS 5.0)
- CVE-2025-15386 — Responsive Lightbox & Gallery < 2.6.1 - Unauthenticated Stored XSS (CVSS 8.8)
- CVE-2025-12359 — Responsive Lightbox & Gallery <= 2.5.3 - Authenticated (Author+) Server-Side Request Forgery (CVSS 5.4)
- CVE-2025-9710 — Responsive Lightbox & Gallery < 2.5.3 - Unauthenticated Stored-XSS via Comments (CVSS 6.3)
- CVE-2025-5093 — Responsive Lightbox & Gallery < 2.5.2 - Contributor+ Stored XSS (CVSS 5.4)
- CVE-2025-3742 — Responsive Lightbox & Gallery < 2.5.1 - Contributor+ Stored XSS (CVSS 6.8)
- CVE-2024-5667 — Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Library (CVSS 6.4)
- CVE-2024-5020 — Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library (CVSS 6.4)
- CVE-2024-43924 — WordPress Responsive Lightbox & Gallery plugin <= 2.4.7 - Broken Access Control vulnerability (CVSS 9.8)
- CVE-2024-49282 — WordPress Responsive Lightbox & Gallery plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- CVE-2024-6870 — Responsive Lightbox & Gallery <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload (CVSS 5.4)
- CVE-2023-49174 — WordPress Responsive Lightbox Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)
- CVE-2017-2243 — (CVSS 6.1)