Dfactory
21 CVEs across 10 Dfactory products. Browse Dfactory vulnerabilities, severities, and proof-of-concept exploits.
Dfactory products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56041 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions. |
CVE-2026-39616 | Medium | 5.3 | 2026-04-08 | Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured A… |
CVE-2026-2479 | Medium | 5.0 | 2026-02-25 | The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.1. This is due to… |
CVE-2025-12359 | Medium | 5.4 | 2025-11-19 | The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.3 via the 'get_im… |
CVE-2025-62941 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Events Maker by dFactory events-maker allows Sto… |
CVE-2025-5093 | Medium | 5.4 | 2025-06-27 | The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting… |
CVE-2025-49995 | Medium | 5.3 | 2025-06-20 | Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured A… |
CVE-2025-3742 | Medium | 6.8 | 2025-05-15 | The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post… |
CVE-2024-5667 | Medium | 6.4 | 2025-03-05 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Featherlight.js JavaScript library (versions 1.7.13 to 1… |
CVE-2024-5020 | Medium | 6.4 | 2024-12-04 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in… |
CVE-2024-43924 | Medium | 5.3 | 2024-10-23 | Missing Authorization vulnerability in dFactory Responsive Lightbox allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Responsi… |
CVE-2024-49282 | Medium | 5.9 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox responsive-lightbox allows S… |
CVE-2024-6870 | Medium | 6.4 | 2024-08-22 | The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.4… |
CVE-2024-31252 | Medium | 4.3 | 2024-06-09 | Missing Authorization vulnerability in dFactory Responsive Lightbox.This issue affects Responsive Lightbox: from n/a through 2.4.6. |
CVE-2024-3230 | Medium | 6.4 | 2024-06-04 | The Download Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'download-attachments' shortcode in all versions up… |
CVE-2024-31264 | Medium | 4.3 | 2024-04-12 | Unauthenticated Cross Site Request Forgery (CSRF) in Post Views Counter <= 1.4.4 versions. |
CVE-2024-1994 | Medium | 4.3 | 2024-04-06 | The Image Watermark plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the watermark_action_ajax() fu… |
CVE-2023-49174 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox & Gallery allows Stored XSS… |
CVE-2023-0076 | Medium | 5.4 | 2023-03-06 | The Download Attachments WordPress plugin before 1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post w… |
CVE-2021-24613 | Medium | 4.8 | 2021-09-20 | The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which could allow high privilege users to perfo… |
CVE-2017-2243 | Medium | 6.1 | 2017-07-07 | Cross-site scripting vulnerability in Responsive Lightbox prior to version 1.7.2 allows an attacker to inject arbitrary web script or HTML via unspecified vect… |