CVE-2024-4427

CVE-2024-4427 concerns the WordPress plugin Comparison Slider . The vulnerability exists in all versions up to and including 1.0.5 due to a missing capability check on several AJAX actions . This can allow authenticated attackers with subscriber access or higher to modify data, including plugin s...

PT-2024-31095 · WordPress · Comparison Slider

Name of the Vulnerable Software and Affected Versions: Comparison Slider plugin for WordPress versions up to, and including, 1.0.5 Description: The issue allows authenticated attackers with subscriber access or above to modify data due to a missing capability check on several AJAX actions. This...

CVE-2023-6528

The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution...

Remote code execution

The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution...

Slider Revolution < 6.6.19 - Author+ Insecure Deserialization leading to RCE

Description The plugin does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution. PoC 1. Make sure to configure the plugin so Authors can access its settings 2. Create a new slider. 3. Save and...

CVE-2023-47226

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in I Thirteen Web Solution Post Sliders & Post Grids plugin = 1.0.20 versions...

CVE-2023-47226

A vulnerability in Nks Post Sliders & Post Grids post-slider-carousel.This issue affects Post Sliders & Post Grids: from n/a through = 1.0.20...

CVE-2023-47226 WordPress Post Sliders & Post Grids Plugin <= 1.0.20 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in I Thirteen Web Solution Post Sliders & Post Grids plugin = 1.0.20 versions...

CVE-2023-47226

CVE-2023-47226 affects the WordPress plugin Post Sliders & Post Grids (I Thirteen Web Solution) up to version 1.0.20. Root cause is an authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability, enabling an administrator to inject scripts that could be executed in other users’ context...

CVE-2023-47226 WordPress Post Sliders & Post Grids Plugin <= 1.0.20 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in I Thirteen Web Solution Post Sliders & Post Grids plugin = 1.0.20 versions...

CVE-2023-47226: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in I Thirteen Web Solution Post Sliders & Post Grids plugin = 1.0.20 versions...

WordPress Plugin Post Sliders & Post Grids Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WordPress Post Sliders & Post Grids Plugin <= 1.0.20 is vulnerable to Cross Site Scripting (XSS)

Software Post Sliders & Post Grids Type Plugin Vulnerable versions = 1.0.20 Fixed in 1.0.21 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-47226 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID d376148f362b Credits yuyudhn...

CVE-2023-5821

The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the deleteselected function. This makes it possible for unauthenticated attackers to delete sliders in bulk via a forged request granted they c...

CVE-2023-5821: Undefined Security Weakness

The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the deleteselected function. This makes it possible for unauthenticated attackers to delete sliders in bulk via a forged request granted they c...

Sliderby10Web < 1.2.53 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Go to "Slider » Sliders" and edit one of the...

Sliderby10Web < 1.2.53 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Go to "Slider » Sliders" and edit one of...

CVE-2022-1303

The CVE-2022-1303 entry concerns the WordPress Slide Anything plugin prior to version 2.3.44. The vulnerability is a stored Cross-Site Scripting (XSS) flaw caused by insufficient sanitization/escaping of the sliders’ description, allowing elevated users (Editor+ or similar) to inject script code,...

PT-2022-13790

Name of the Vulnerable Software and Affected Versions Slide Anything WordPress plugin versions prior to 2.3.44 Description The issue allows high privilege users, such as editors and above, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitize and...

PT-2022-18635

Name of the Vulnerable Software and Affected Versions Yooslider Yoo Slider versions 2.0.0 and earlier Description A Cross-Site Request Forgery CSRF issue allows attackers to create or modify sliders. Recommendations For versions 2.0.0 and earlier, update to a version later than 2.0.0 to resolve t...