Login Request a demo
DF
Vendor
dfactory
6 products with CVEs on record
25
CVEs
0
On KEV
1
New 30D
Products
RL
Responsive Lightbox & Gallery
dfactory
8.8
8 CVEs0 on KEV1 new
RL
Responsive Lightbox
dFactory
9.8
9 CVEs0 on KEV0 new
DA
Download Attachments
dfactory
6.4
4 CVEs0 on KEV0 new
PV
Post Views Counter
dFactory
4.8
2 CVEs0 on KEV0 new
EM
Events Maker by dFactory
dFactory
6.5
1 CVEs0 on KEV0 new
IW
Image Watermark
dfactory
4.3
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-103897
RL
Responsive Lightbox & Gallery
dfactory
4.4
0%
Oct 10Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute
CVE-2026-56041
RL
Responsive Lightbox
dFactory
7.1
0%
Jun 26WordPress Responsive Lightbox plugin <= 2.7.6 - Cross Site Scripting (XSS) vulnerability
CVE-2026-39616
DA
Download Attachments
dFactory
5.3
0%
Apr 8WordPress Download Attachments plugin <= 1.4.0 - Insecure Direct Object References (IDOR) vulnerability
CVE-2026-2479
RL
Responsive Lightbox & Gallery
dfactory
5.0
0%
Feb 25Responsive Lightbox & Gallery <= 2.7.1 - Authenticated (Author+) Server-Side Request Forgery via Remote Library Image Upload
CVE-2025-12359
RL
Responsive Lightbox & Gallery
dfactory
5.4
0%
Nov 19Responsive Lightbox & Gallery <= 2.5.3 - Authenticated (Author+) Server-Side Request Forgery
CVE-2025-62941
EM
Events Maker by dFactory
dFactory
6.5
0%
Oct 27WordPress Events Maker by dFactory plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability
CVE-2025-5093
RL
Responsive Lightbox
Dfactory
5.4
0%
Jun 27Responsive Lightbox & Gallery < 2.5.2 - Contributor+ Stored XSS
CVE-2025-49995
DA
Download Attachments
dFactory
5.3
0%
Jun 20WordPress Download Attachments plugin <= 1.3.1 - Insecure Direct Object References (IDOR) vulnerability
CVE-2025-3742
RL
Responsive Lightbox
Dfactory
6.8
1%
May 15Responsive Lightbox & Gallery < 2.5.1 - Contributor+ Stored XSS
CVE-2024-5667
RL
Responsive Lightbox & Gallery
dfactory
6.4
0%
Mar 5Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Library
CVE-2024-5020
RL
Responsive Lightbox & Gallery
dfactory
6.4
0%
Dec 4Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library
CVE-2024-43924
RL
Responsive Lightbox
dFactory
9.8
1%
Oct 23WordPress Responsive Lightbox & Gallery plugin <= 2.4.7 - Broken Access Control vulnerability
CVE-2024-49282
RL
Responsive Lightbox
dFactory
5.9
0%
Oct 17WordPress Responsive Lightbox & Gallery plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability
CVE-2024-6870
RL
Responsive Lightbox & Gallery
dfactory
5.4
0%
Aug 22Responsive Lightbox & Gallery <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload
CVE-2024-31252
RL
Responsive Lightbox
dFactory
8.8
0%
Jun 9WordPress Responsive Lightbox & Gallery plugin <= 2.4.6 - Broken Access Control vulnerability
CVE-2024-3230
DA
Download Attachments
dfactory
6.4
0%
Jun 4Download Attachments <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2024-31264
PV
Post Views Counter
dFactory
4.3
0%
Apr 12WordPress Post Views Counter plugin <= 1.4.4 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2024-1994
IW
Image Watermark
dfactory
4.3
0%
Apr 6Image Watermark <= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Watermark Modification
CVE-2023-49174
RL
Responsive Lightbox & Gallery
dFactory
5.4
0%
Dec 15WordPress Responsive Lightbox Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)
CVE-2023-0076
DA
Download Attachments
Dfactory
5.4
0%
Mar 6Download Attachments < 1.3 - Contributor+ Stored XSS
CVE-2021-24613
PV
Post Views Counter
Dfactory
4.8
1%
Sep 20The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which could allow high privilege users to perform Cross-Site…
CVE-2017-2243
RL
Responsive Lightbox
Dfactory
6.1
1%
Jul 7Cross-site scripting vulnerability in Responsive Lightbox prior to version 1.7.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors