CVE-2024-6870

The CVE-2024-6870 entry concerns the WordPress plugin Responsive Lightbox & Gallery. A stored XSS exists via file uploads in all versions up to 2.4.7, due to insufficient input sanitization and output escaping in the rl_upload_image AJAX endpoint. Authenticated attackers with Author-level access ...

CVE-2023-49174

CVE-2023-49174 concerns the WordPress plugin Responsive Lightbox & Gallery (dFactory) and is a cross-site scripting (XSS) vulnerability caused by improper input neutralization during web page generation. The issue is a Stored XSS affecting plugin versions 2.4.5 and earlier. Public sources explici...

CVE-2024-43924

CVE-2024-43924 concerns a Missing Authorization vulnerability in the WordPress plugin dFactory Responsive Lightbox, affecting versions from n/a to 2.4.7 and allowing access to functionality not properly constrained by ACLs. The issue is described as a Missing Authorization vulnerability with high...

CVE-2025-3742

The Responsive Lightbox & Gallery WordPress plugin (versions prior to 2.5.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly validate and escape certain attributes before they are output back in a page or post. This allows users with the contributor...

CVE-2025-5093

The Responsive Lightbox & Gallery WordPress plugin (versions prior to 2.5.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the Swipebox library failing to validate and escape title attributes before outputting them back in a page or post. This allows users with contribut...