PT-2024-23237 · Unknown · The Prime Slider – Addons For Elementor

Name of the Vulnerable Software and Affected Versions: BdThemes Prime Slider – Addons For Elementor versions 3.13.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means...

WordPress Plugin Post Grid, Slider & Carousel Ultimate 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

WordPress Plugin Prime Slider 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2024-1745

The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial Slider WordPress plugin before 2.3.7 settings, making it possible for users with at least the Author role to edit them...

CVE-2024-1745

The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial Slider WordPress plugin before 2.3.7 settings, making it possible for users with at least the Author role to edit them...

CVE-2024-1745 Testimonial Slider < 2.3.7 - Author+ Settings Update

The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial Slider WordPress plugin before 2.3.7 settings, making it possible for users with at least the Author role to edit them...

CVE-2024-1745 Testimonial Slider < 2.3.7 - Author+ Settings Update

The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial Slider WordPress plugin before 2.3.7 settings, making it possible for users with at least the Author role to edit them...

CVE-2024-2732

The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'themifypostslider shortcode in all versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Testimonial Slider Plugin < 2.3.7 is vulnerable to Broken Access Control

Software Testimonial Slider Type Plugin Vulnerable versions 2.3.7 Fixed in 2.3.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-1745 Patch priority Low CVSS severity Low 2.7 Developer Claim ownership PSID e4275e227f6f Credits Dmitrii Ignatyev Required...

WordPress Slider by Supsystic Plugin <= 1.8.10 is vulnerable to SQL Injection

Software Slider by Supsystic Type Plugin Vulnerable versions = 1.8.10 Fixed in 1.8.11 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30237 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 6fa97cac7811 Credits Jean Tirstan T Required privilege...

WordPress Plugin Testimonial Slider 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

Testimonial Slider < 2.3.8 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Go to "Testimonial Shortcode" 2. Ad...

Testimonial Slider < 2.3.8 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Go to "Testimonial Shortcode"...

WordPress Slider Hero Plugin <= 8.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Slider Hero Type Plugin Vulnerable versions = 8.6.1 Fixed in 8.7.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29922 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b14fdd6b236b Credits Jean Tirstan T Required privilege...

PT-2024-18270 · WordPress · Testimonial Slider

Name of the Vulnerable Software and Affected Versions: Testimonial Slider WordPress plugin versions prior to 2.3.7 Description: The issue arises from the plugin not properly ensuring that a user has the necessary capabilities to edit certain sensitive settings, making it possible for users with a...

Carousel Slider < 2.2.7 - Editor+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Add a new slider at "Carousel...

WordPress Post Grid, Slider & Carousel Ultimate Plugin <= 1.6.6 is vulnerable to Cross Site Scripting (XSS)

Software Post Grid, Slider & Carousel Ultimate Type Plugin Vulnerable versions = 1.6.6 Fixed in 1.6.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29925 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e415424c3ca8 Credits LVT-tholv2k...

WordPress Prime Slider – Addons For Elementor Plugin <= 3.13.1 is vulnerable to Cross Site Scripting (XSS)

Software Prime Slider – Addons For Elementor Type Plugin Vulnerable versions = 3.13.1 Fixed in 3.13.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30186 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cecca2643bee Credits Khalid Yusuf...

Carousel Slider < 2.2.7 - Editor+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Add a new slider at "Carousel Slide...

CVE-2024-24883 WordPress Prime Slider plugin <= 3.11.10 - Broken Access Control on Duplicate Post vulnerability

Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.11.10...