70 matches found
Critical Security Flaw Found in Popular LayerSlider WordPress Plugin
A critical security flaw impacting the LayerSlider plugin for WordPress could be abused to extract sensitive information from databases, such as password hashes. The flaw, designated as CVE-2024-2879, carries a CVSS score of 9.8 out of a maximum of 10.0. It has been described as a case of SQL...
CVE-2024-2879
The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the lsgetpopupmarkup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated...
CVE-2024-2879
The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the lsgetpopupmarkup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated...
CVE-2024-2879
The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the lsgetpopupmarkup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated...
CVE-2024-2879
The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the lsgetpopupmarkup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated...
CVE-2024-2879
The WordPress LayerSlider plugin (versions 7.9.11–7.10.0) is vulnerable to SQL injection via the ls_get_popup_markup action. The root cause is insufficient escaping of user-supplied parameters and inadequate preparation of the SQL query, allowing unauthenticated attackers to append additional SQL...
WordPress LayerSlider plugin 7.9.11-7.10.0 - Unauth. SQL Injection vulnerability
Unauth. SQL Injection vulnerability discovered by AmrAwad in WordPress Plugin LayerSlider versions 7.9.11 - 7.10.0...
$5,500 Bounty Awarded for Unauthenticated SQL Injection Vulnerability Patched in LayerSlider WordPress Plugin
On March 25th, 2024, during our second Bug Bounty Extravaganza, we received a submission for an unauthenticated SQL Injection vulnerability in LayerSlider, a WordPress plugin with more than 1,000,000 estimated active installations. This vulnerability can be leveraged to extract sensitive data fro...
WordPress LayerSlider Plugin 7.9.11 - 7.10.0 is vulnerable to SQL Injection
Software LayerSlider Type Plugin Vulnerable versions 7.9.11 - 7.10.0 Fixed in 7.10.1 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-2879 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID f3cdf1aebfe3 Credits AmrAwad Required privilege Unauthenticated...
PT-2024-3163 · WordPress · Layerslider
Name of the Vulnerable Software and Affected Versions: LayerSlider plugin for WordPress versions 7.9.11 through 7.10.0 Description: The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls get popup markup action due to insufficient escaping on the user-supplied id parameter...
LayerSlider 7.9.11 - 7.10.0 - Unauthenticated SQL Injection
Description The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the lsgetpopupmarkup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
LayerSlider < 7.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The LayerSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 7.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...
LayerSlider < 7.7.10 - Cross-Site Request Forgery
Description The LayerSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.7.9. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this function via a...
CVE-2023-47786
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LayerSlider plugin = 7.7.9 versions...
CVE-2023-47786
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LayerSlider plugin = 7.7.9 versions...
Cross site scripting
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LayerSlider plugin = 7.7.9 versions...
CVE-2023-47786 WordPress LayerSlider Plugin <= 7.7.9 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LayerSlider plugin = 7.7.9 versions...
CVE-2023-47786
CVE-2023-47786 – LayerSlider (WordPress) stored XSS . The WordPress LayerSlider plugin versions