Filtered by vendor Dfactory Subscriptions
Total 6 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-43924 1 Dfactory 1 Responsive Lightbox 2024-11-06 5.3 Medium
Missing Authorization vulnerability in dFactory Responsive Lightbox allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Responsive Lightbox: from n/a through 2.4.7.
CVE-2024-6870 1 Dfactory 1 Responsive Lightbox 2024-09-27 6.4 Medium
The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping affecting the rl_upload_image AJAX endpoint. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the 3gp2 file.
CVE-2017-2243 1 Dfactory 1 Responsive Lightbox 2024-08-05 N/A
Cross-site scripting vulnerability in Responsive Lightbox prior to version 1.7.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVE-2021-24613 1 Dfactory 1 Post Views Counter 2024-08-03 4.8 Medium
The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which could allow high privilege users to perform Cross-Site Scripting attacks in the frontend even when the unfiltered_html capability is disallowed
CVE-2023-49174 1 Dfactory 1 Responsive Lightbox 2024-08-02 5.9 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox & Gallery allows Stored XSS.This issue affects Responsive Lightbox & Gallery: from n/a through 2.4.5.
CVE-2023-0076 1 Dfactory 1 Download Attachments 2024-08-02 5.4 Medium
The Download Attachments WordPress plugin before 1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.