CVE-2024-6026

The CVE-2024-6026 issue affects the Slider by 10Web WordPress plugin prior to version 1.2.56. The vulnerability arises from insufficient sanitisation/escaping of certain Slide options, allowing authenticated users with access to the Sliders (default Administrator, configurable) who can add images...

PT-2024-37329 · 10Web · Sliderby10Web Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Slider by 10Web WordPress plugin version 1.2.55 and earlier Description: The issue concerns the Slider by 10Web WordPress plugin, which does not properly sanitise and escape some of its Slide options. This could allow authenticated users...

WordPress plugin Slider by 10Web Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

WordPress Master Slider Plugin <= 3.10.0 is vulnerable to Cross Site Scripting (XSS)

Software Master Slider Type Plugin Vulnerable versions = 3.10.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37222 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 90295bc054b8 Credits Rafie Muhammad Patchstack Required...

CVE-2024-5649

The CVE-2024-5649 entry concerns Universal Slider (fusion-slider) for WordPress, affected up to version 1.6.5. It describes PHP Object Injection via deserialization of untrusted input in the fsl_get_gallery_value function. The advisory states that authenticated attackers with Contributor-level ac...

PT-2024-30637 · WordPress · The Master Slider

Name of the Vulnerable Software and Affected Versions: The Master Slider – Responsive Touch Slider plugin for WordPress versions up to, and including, 3.9.10 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'ms layer' shortcode due to insufficient input sanitizati...

WordPress Master Slider Plugin <= 3.9.10 is vulnerable to Cross Site Scripting (XSS)

Software Master Slider Type Plugin Vulnerable versions = 3.9.10 Fixed in 3.10.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4375 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1a4a36dfa73c Credits Krzysztof Zając Required...

WordPress plugin Media Slider security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-3288

The Logo Slider WordPress plugin before 4.0.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-4426

The Comparison Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on several functions hooked to AJAX actions. This makes it possible for unauthenticated attackers to change slid...

PT-2024-31086 · WordPress · Comparison Slider

Name of the Vulnerable Software and Affected Versions: Comparison Slider plugin for WordPress versions up to, and including, 1.0.5 Description: The issue is due to missing or incorrect nonce validation on several functions hooked to AJAX actions, making it possible for unauthenticated attackers t...

CVE-2024-3997

The CVE-2024-3997 issue affects WordPress plugin Prime Slider – Addons For Elementor (bdthemes-prime-slider-lite). It is a Stored Cross-Site Scripting vulnerability in the Pagepiling widget, present in all versions up to 3.14.1, caused by insufficient input sanitization and output escaping on use...

CVE-2024-4372

The Carousel Slider WordPress plugin before 2.2.11 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks...

Ultimate Store Kit Elementor Addons <= 1.6.2 - Unauthenticated PHP Object Injection

Description The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.2 via deserialization of untrusted...

CVE-2024-4193

The Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'testimonialcategory' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-3703

The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embed, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks...

WordPress plugin Image Slider 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Carousel Slider 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-2310

The CVE-2024-2310 entry concerns the WP Google Review Slider WordPress plugin (versions before 13.6). It states that certain settings are not sanitised/escaped, enabling Stored Cross-Site Scripting by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (including multisite...

WordPress plugin Image Slider 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...