CVE-2021-24730

CVE-2021-24730 affects the WordPress plugin “Logo Showcase with Slick Slider” prior to version 1.2.5. The issue is an absence of CSRF and authorization checks in the lswss_save_attachment_data AJAX action, allowing any authenticated user (e.g., Subscriber) to modify title, description, alt text, ...

WordPress Logo Showcase with Slick Slider plugin < 2.0.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Logo Showcase with Slick Slider plugin versions 2.0.3. Solution Update the WordPress Logo Showcase with Slick Slider plugin to the latest available version at least 2.0.3...

WordPress Logo Showcase with Slick Slider plugin < 2.0.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Logo Showcase with Slick Slider plugin versions 2.0.3. Solution Update the WordPress Logo Showcase with Slick Slider plugin to the latest available version at least 2.0.3...

WordPress 跨站请求伪造漏洞

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. cross-site request forgery vulnerability exists in versions of the WordPress Slick Slider plugin prior to 2.0.1, which stems...

PT-2022-9454 · WordPress · The Logo Showcase With Slick Slider

Name of the Vulnerable Software and Affected Versions: The Logo Showcase with Slick Slider WordPress plugin versions prior to 1.2.5 Description: The issue concerns a lack of CSRF and authorization checks in the lswss save attachment data AJAX action. This allows any authenticated user to modify...

WordPress plugin Logo Showcase with Slick Slider 访问控制错误漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. An access control error vulnerability exists in the WordPress...

WordPress Logo Showcase with Slick Slider plugin <= 2.0 - Arbitrary Media Title/Description/Alt Text/URL Update via CSRF vulnerability

Arbitrary Media Title/Description/Alt Text/URL Update via CSRF vulnerability discovered by apple502j in WordPress Logo Showcase with Slick Slider plugin versions = 2.0. Solution Update the WordPress Logo Showcase with Slick Slider plugin to the latest available version at least 2.0.1...

Logo Showcase with Slick Slider < 2.0.1 - Arbitrary Media Title/Description/Alt Text/URL Update via CSRF

The plugin does not have CSRF check in the lswsssaveattachmentdata AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media. jQuery.postajaxurl, action: "lswsssaveattachmentdata", attachmentid: 564, formdata:...

Logo Showcase with Slick Slider < 2.0.1 - Arbitrary Media Title/Description/Alt Text/URL Update via CSRF

The plugin does not have CSRF check in the lswsssaveattachmentdata AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media. PoC jQuery.postajaxurl, action: "lswsssaveattachmentdata", attachmentid: 564,...

CVE-2021-24729

The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase...

CVE-2021-24729 Logo Showcase with Slick Slider < 1.2.4 - Author+ Stored Cross Site Scripting

The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase...

CVE-2021-24729

CVE-2021-24729 concerns the WordPress plugin “Logo Showcase with Slick Slider” (versions before 1.2.4). The vulnerability is a failure to sanitize Grid Settings, enabling stored Cross-Site Scripting via post metadata and allowing unaffiliated authors or users with low privileges to inject script....

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress Slick Slider suffers from a cross-site scripting vulnerability that stems from the WEB...

WordPress Logo Showcase with Slick Slider plugin <= 1.2.4 - Arbitrary Media Title/Description/Alt Text/URL Update vulnerability

Arbitrary Media Title/Description/Alt Text/URL Update vulnerability discovered by apple502j in WordPress Logo Showcase with Slick Slider plugin versions = 1.2.4. Solution Update the WordPress Logo Showcase with Slick Slider plugin to the latest available version at least 1.2.5...

WordPress Logo Showcase with Slick Slider plugin <= 1.2.3 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Logo Showcase with Slick Slider plugin versions = 1.2.3. Solution Update the WordPress Logo Showcase with Slick Slider plugin to the latest available version at least 1.2.4...

Logo Showcase with Slick Slider < 1.2.4 - Author+ Stored Cross Site Scripting

The plugin does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase. PoC 1 Create a Logo Showcase 2 Set display type to Logo Grid 3 Set number of grid to 1"...

Logo Showcase with Slick Slider < 1.2.4 - Author+ Stored Cross Site Scripting

The plugin does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase. 1 Create a Logo Showcase 2 Set display type to Logo Grid 3 Set number of grid to 1"...