CVE-2023-1915

CVE-2023-1915 affects the WordPress plugin Thumbnail carousel slider (versions before 1.1.10). The issue is caused by insufficient sanitisation/escaping of certain parameters before echoing them in pages, enabling a Reflected XSS that could target high-privilege users such as admins. The vulnerab...

PT-2023-17336 · WordPress · Thumbnail Carousel Slider

Name of the Vulnerable Software and Affected Versions: Thumbnail carousel slider WordPress plugin versions prior to 1.1.10 Description: The issue is related to Reflected Cross-Site Scripting, where some parameters are not properly sanitised and escaped before being outputted back in pages. This...

WordPress plugin Thumbnail carousel slider 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Thumbnail carousel slider Plugin < 1.1.10 is vulnerable to Cross Site Scripting (XSS)

Software Thumbnail carousel slider Type Plugin Vulnerable versions 1.1.10 Fixed in 1.1.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1915 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID fe3b77853da1 Credits Chien Vuong...

CVE-2023-2120

The Thumbnail carousel slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchterm parameter in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2023-2120

The Thumbnail carousel slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchterm parameter in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

Cross site scripting

The Thumbnail carousel slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchterm parameter in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2023-2120 Thumbnail carousel slider <= 1.1.9 - Reflected Cross-Site Scripting

The Thumbnail carousel slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchterm parameter in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

WordPress plugin Thumbnail carousel slider 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2023-17988 · WordPress · Thumbnail Carousel Slider

Name of the Vulnerable Software and Affected Versions: Thumbnail carousel slider plugin for WordPress versions up to, and including, 1.1.9 Description: The issue is related to Reflected Cross-Site Scripting via the search term parameter due to insufficient input sanitization and output escaping...

WordPress Thumbnail carousel slider Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)

Software Thumbnail carousel slider Type Plugin Vulnerable versions = 1.1.9 Fixed in 1.1.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2120 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID b8405ab8f136 Credits Marco...

WordPress Thumbnail carousel slider plugin <= 1.0 - Stored Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerabilities

Stored Cross-Site Scripting XSS and Cross-Site Request Forgery CSRF vulnerabilities found by Arash Khazaei in WordPress Thumbnail carousel slider plugin versions = 1.0. Solution Update the WordPress Thumbnail carousel slider plugin to the latest available version at least 1.0.1...

WordPress Thumbnail carousel slider plugin <= 1.0 - Authenticated Shell Upload and Cross-Site Request Forgery (CSRF) vulnerabilities

Authenticated Shell Upload and Cross-Site Request Forgery CSRF vulnerabilities found by Arash Khazaei in WordPress Thumbnail carousel slider plugin versions = 1.0. Solution Update the WordPress Thumbnail carousel slider plugin to the latest available version at least 1.0.1...

Thumbnail Carousel Slider < 1.0.1 - Stored Cross-Site Scripting (XSS) & CSRF

The original advisory states that this vulnerability is exploitable with editor and author roles but this is incorrect. Only the administrator role by default can trigger this vulnerability. However, CSRF on the image upload form makes this exploitable by a malicious actor...