CVE-2021-24730

🗓️ 28 Feb 2022 09:06:07Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 101 Views🌐 WEB

The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 allows authenticated users to modify media details

Reporter	Title	Published	Views	Family All 10
CNNVD	WordPress plugin Logo Showcase with Slick Slider 访问控制错误漏洞	28 Feb 202200:00	–	cnnvd
Cvelist	CVE-2021-24730 Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update	28 Feb 202209:06	–	cvelist
EUVD	EUVD-2021-11642	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24730	28 Feb 202209:15	–	nvd
Patchstack	WordPress Logo Showcase with Slick Slider plugin <= 1.2.4 - Arbitrary Media Title/Description/Alt Text/URL Update vulnerability	24 Oct 202100:00	–	patchstack
Prion	Cross site request forgery (csrf)	28 Feb 202209:15	–	prion
Positive Technologies	PT-2022-9454 · WordPress · The Logo Showcase With Slick Slider	28 Feb 202200:00	–	ptsecurity
RedhatCVE	CVE-2021-24730	22 May 202519:23	–	redhatcve
wpexploit	Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update	24 Oct 202100:00	–	wpexploit
WPVulnDB	Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update	24 Oct 202100:00	–	wpvulndb

NVD

Vulners

Node

infornweb logo_showcase_with_slick_sliderRange<1.2.5wordpress

[
  {
    "product": "Logo Showcase with Slick Slider – Logo Carousel, Logo Slider & Logo Grid",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.2.5",
        "status": "affected",
        "version": "1.2.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/d5534ff9-c4af-46b7-8852-0f3dfd644855

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-ajax.php	Missing CSRF and authorization checks in lswss_save_attachment_data AJAX action allows any authenticated user to modify media metadata (title, description, alt text, URL) of arbitrary uploaded media.	CWE-862, CWE-352
attachment_id	request body	wp-admin/admin-ajax.php	Missing CSRF and authorization checks in lswss_save_attachment_data AJAX action allows any authenticated user to modify media metadata (title, description, alt text, URL) of arbitrary uploaded media.	CWE-862, CWE-352
form_data	request body	wp-admin/admin-ajax.php	Missing CSRF and authorization checks in lswss_save_attachment_data AJAX action allows any authenticated user to modify media metadata (title, description, alt text, URL) of arbitrary uploaded media.	CWE-862, CWE-352

17 Jun 2026 03:40Current

4.6Medium risk

Vulners AI Score4.6

CVSS 24

CVSS 3.14.3

EPSS0.00339