4690 matches found
Master Slider Pro <= 3.6.5 - Reflected Cross-Site Scripting
Description The Master Slider Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
SEO Slider < 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The SEO Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slider' shortcode and post meta in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...
Thumbnail carousel slider < 1.0.1 - Cross-Site Request Forgery to Mass Slider Deletion
Description The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the deleteselected function. This makes it possible for unauthenticated attackers to delete sliders in bulk via a forged request...
Slider Revolution < 6.6.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.6.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to...
video carousel slider with lightbox 1.0 - Cross-Site Request Forgery
Description The video carousel slider with lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the responsivevideogallerywithlightboxvideomanagementfunc function. This makes it possible for unauthenticat...
Slider Revolution < 6.6.16 - Authenticated (Author+) Arbitrary File Upload
Description The Slider Revolution plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 6.6.15. This makes it possible for attackers with author-level access and higher to upload arbitrary files on the affected site's server which may make remote code...
Slider - Ultimate Responsive Image Slider < 3.5.12 - Subscriber+ Arbitrary Post Access
Description The plugin does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protected Run the below...
CVE-2023-47785
Cross-Site Request Forgery CSRF vulnerability in LayerSlider plugin = 7.7.9 versions...
CVE-2023-47755
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AazzTech WooCommerce Product Carousel Slider plugin = 3.3.5 versions...
CVE-2023-47755
CVE-2023-47755: AzzTech WooCommerce Product Carousel Slider plugin
CVE-2023-5466
The Wp anything slider plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2023-5466
The Wp anything slider plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
Sql injection
The Wp anything slider plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2023-5466 Wp anything slider <= 9.1 - Authenticated (Subscriber+) SQL Injection via Shortcode
The Wp anything slider plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2023-5466
CVE-2023-5466 affects the WordPress plugin WP Anything Slider, up to version 9.1. The issue is an SQL Injection due to insufficient escaping of user-supplied shortcode parameters and lack of proper query preparation, enabling authenticated attackers with subscriber-level+ permissions to inject ad...
PT-2023-30589 · Aazztech · Aazztech Woocommerce Product Carousel Slider
Name of the Vulnerable Software and Affected Versions: AazzTech WooCommerce Product Carousel Slider plugin versions prior to 3.3.6 Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations: For version...
WordPress Plugin WooCommerce Product Carousel Slider Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
WordPress Plugin Wp anything slider security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2023-32121 · WordPress · Wp Anything Slider Plugin
Name of the Vulnerable Software and Affected Versions: Wp anything slider plugin for WordPress versions up to, and including, 9.1 Description: The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the plugin's...