CVE-2022-4482

The CVE-2022-4482 entry covers the WP Carousel (Carousel, Slider, Gallery) WordPress plugin before version 2.5.3. The vulnerability is a Stored XSS caused by insufficient validation and escaping of shortcode attributes, enabling a low-privilege user (contributor) to inject scripts that could affe...

CVE-2022-4482 Carousel, Slider, Gallery by WP Carousel < 2.5.3 - Contributor+ Stored XSS

The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be...

CVE-2022-4482: Undefined Security Weakness

The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be...

WordPress plugin Carousel、Slider、Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2023-14557 · WordPress · Carousel

Name of the Vulnerable Software and Affected Versions: The Carousel, Slider, Gallery by WP Carousel WordPress plugin versions prior to 2.5.3 Description: The issue allows users with a role as low as contributor to perform Stored Cross-Site Scripting attacks, which could be used against high...

WordPress Post Grid, Post Carousel, & List Category Posts – by Smart Post Show Plugin < 2.3.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Post Grid, Post Carousel, & List Category Posts – by Smart Post Show Type Plugin Vulnerable versions 2.3.5 Fixed in 2.3.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

Post Grid, Post Carousel, & List Category Posts < 2.4.19 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Exploit Additional CSS classes for "Smart Post Show"...

WordPress Post Grid, Post Carousel, & List Category Posts – by Smart Post Show Plugin < 2.4.19 is vulnerable to Cross Site Scripting (XSS)

Software Post Grid, Post Carousel, & List Category Posts – by Smart Post Show Type Plugin Vulnerable versions 2.4.19 Fixed in 2.4.19 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0097 Patch priority Medium CVSS severity Medium 6.5 Developer Claim...

WordPress Product Slider and Carousel with Category for WooCommerce Plugin < 2.8 is vulnerable to Cross Site Scripting (XSS)

Software Product Slider and Carousel with Category for WooCommerce Type Plugin Vulnerable versions 2.8 Fixed in 2.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4791 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID...

WordPress CPT Bootstrap Carousel Plugin <= 1.12 is vulnerable to Cross Site Scripting (XSS)

Software CPT Bootstrap Carousel Type Plugin Vulnerable versions = 1.12 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4834 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 49016ec732ce Credits István Márton...

Carousel, Slider, Gallery by WP Carousel < 2.5.3 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Exploit...

CVE-2022-4600

A vulnerability was found in Shoplazza LifeStyle 1.1. It has been classified as problematic. This affects an unknown part of the file /admin/api/theme-edit/ of the component Product Carousel Handler. The manipulation of the argument Heading/Description leads to cross site scripting. It is possibl...

CVE-2022-4600

A vulnerability was found in Shoplazza LifeStyle 1.1. It has been classified as problematic. This affects an unknown part of the file /admin/api/theme-edit/ of the component Product Carousel Handler. The manipulation of the argument Heading/Description leads to cross site scripting. It is possibl...

Cross site scripting

A vulnerability was found in Shoplazza LifeStyle 1.1. It has been classified as problematic. This affects an unknown part of the file /admin/api/theme-edit/ of the component Product Carousel Handler. The manipulation of the argument Heading/Description leads to cross site scripting. It is possibl...

PT-2022-27715 · Shoplazza · Shoplazza Lifestyle

Name of the Vulnerable Software and Affected Versions: Shoplazza LifeStyle version 1.1 Description: A vulnerability was found in the Product Carousel Handler component, affecting an unknown part of the file /admin/api/theme-edit/. The manipulation of the Heading/Description argument leads to...

CVE-2022-4600 Shoplazza LifeStyle Product Carousel cross site scripting

A vulnerability was found in Shoplazza LifeStyle 1.1. It has been classified as problematic. This affects an unknown part of the file /admin/api/theme-edit/ of the component Product Carousel Handler. The manipulation of the argument Heading/Description leads to cross site scripting. It is possibl...

CVE-2022-4600: Improper Neutralization

A vulnerability was found in Shoplazza LifeStyle 1.1. It has been classified as problematic. This affects an unknown part of the file /admin/api/theme-edit/ of the component Product Carousel Handler. The manipulation of the argument Heading/Description leads to cross site scripting. It is possibl...

CVE-2022-4600

Shoplazza LifeStyle 1.1 is affected by CVE-2022-4600. The Product Carousel Handler’s /admin/api/theme-edit/ endpoint improperly handles the Heading/Description parameter, enabling cross-site scripting. The attack can be initiated remotely and is documented across multiple sources (NVD/Red Hat/CVE...

CVE-2022-4600 Shoplazza LifeStyle Product Carousel cross site scripting

A vulnerability was found in Shoplazza LifeStyle 1.1. It has been classified as problematic. This affects an unknown part of the file /admin/api/theme-edit/ of the component Product Carousel Handler. The manipulation of the argument Heading/Description leads to cross site scripting. It is possibl...

PT-2026-48634

Name of the Vulnerable Software and Affected Versions YITH WooCommerce Product Slider Carousel versions prior to 1.16.0 Description A Cross-Site Request Forgery CSRF flaw exists in the software. CSRF is a type of attack that tricks a victim into submitting a malicious request. It inherits the...