Filtered by vendor Dfactory Subscriptions
Total 4 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-0076 1 Dfactory 1 Download Attachments 2024-02-13 5.4 Medium
The Download Attachments WordPress plugin before 1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVE-2023-49174 1 Dfactory 1 Responsive Lightbox 2023-12-19 5.4 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox & Gallery allows Stored XSS.This issue affects Responsive Lightbox & Gallery: from n/a through 2.4.5.
CVE-2021-24613 1 Dfactory 1 Post Views Counter 2021-10-01 4.8 Medium
The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which could allow high privilege users to perform Cross-Site Scripting attacks in the frontend even when the unfiltered_html capability is disallowed
CVE-2017-2243 1 Dfactory 1 Responsive Lightbox 2017-07-14 N/A
Cross-site scripting vulnerability in Responsive Lightbox prior to version 1.7.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.