dfactory Responsive Lightbox vulnerabilities

Latest dfactory Responsive Lightbox CVEs

Newest publication first

1. CVE-2026-56041 WordPress Responsive Lightbox plugin <= 2.7.6 - Cross Site Scripting (XSS) vulnerability

   Published 2026-06-26

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions.

2. CVE-2025-5093 Responsive Lightbox & Gallery < 2.5.2 - Contributor+ Stored XSS

   Published 2025-06-27

   Medium·CVSS 5.4 EPSS 0.23%

   The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-...

3. CVE-2025-3742 Responsive Lightbox & Gallery < 2.5.1 - Contributor+ Stored XSS

   Published 2025-05-15

   Medium·CVSS 6.8 EPSS 0.54%

   The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

4. CVE-2024-43924 WordPress Responsive Lightbox & Gallery plugin <= 2.4.7 - Broken Access Control vulnerability

   Published 2024-10-23

   Critical·CVSS 9.8 EPSS 0.53%

   Missing Authorization vulnerability in dFactory Responsive Lightbox allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Responsive Lightbox: from n/a through 2.4.7.

5. CVE-2024-49282 WordPress Responsive Lightbox & Gallery plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability

   Published 2024-10-17

   Medium·CVSS 5.9 EPSS 0.27%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox responsive-lightbox allows Stored XSS.This issue affects Responsive Lightbox: from n/a through <= 2.4.8.

6. CVE-2024-6870 Responsive Lightbox & Gallery <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload

   Published 2024-08-22

   Medium·CVSS 5.4 EPSS 0.33%

   The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping affecting the rl_upload_image AJAX endpoint. This makes it p...

7. CVE-2024-31252 WordPress Responsive Lightbox & Gallery plugin <= 2.4.6 - Broken Access Control vulnerability

   Published 2024-06-09

   High·CVSS 8.8 EPSS 0.36%

   Missing Authorization vulnerability in dFactory Responsive Lightbox.This issue affects Responsive Lightbox: from n/a through 2.4.6.

8. CVE-2023-49174 WordPress Responsive Lightbox Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-12-15

   Medium·CVSS 5.4 EPSS 0.38%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox & Gallery allows Stored XSS.This issue affects Responsive Lightbox & Gallery: from n/a through 2.4.5.

9. CVE-2017-2243 Responsive Lightbox & Gallery <= 1.7.1 - Cross-Site Scripting

   Published 2017-07-07

   Medium·CVSS 6.1 EPSS 1.5%

   Cross-site scripting vulnerability in Responsive Lightbox prior to version 1.7.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.