Vulnerabilities and security researches forsimple-lightbox-gallery simple-lightbox-gallery

Jun 07, 2024

CVE, Research URL: CVE-2024-1858
Home page URL: Security reports for Lightbox slider – Responsive Lightbox Gallery
Application: Lightbox slider – Responsive Lightbox Gallery
Date: Mar 29, 2024
Research Description: The Lightbox slider – Responsive Lightbox Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.9 via deserialization of untrusted input through post meta data. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Affected versions: max 1.10.0.
Status: vulnerable

Oct 18, 2024

CVE, Research URL: CVE-2024-49280
Home page URL: Security reports for Lightbox slider – Responsive Lightbox Gallery
Application: Lightbox slider – Responsive Lightbox Gallery
Date: Oct 18, 2024
Research Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Weblizar Lightbox slider – Responsive Lightbox Gallery allows Stored XSS.This issue affects Lightbox slider – Responsive Lightbox Gallery: from n/a through 1.10.0.
Affected versions: max 1.10.2.
Status: vulnerable