WordPress Ultimate Carousel For Elementor Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Carousel For Elementor Type Plugin Vulnerable versions = 2.1.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0280 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5d4b9d7e6fcb Credits István...

WordPress Ultimate Carousel For WPBakery Page Builder Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Carousel For WPBakery Page Builder Type Plugin Vulnerable versions = 2.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0267 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 8fe712db2127...

Ultimate Carousel For WPBakery Page Builder <= 2.6 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The plugin author was made aware of this...

WordPress Ultimate Carousel For Divi plugin <= 4.3.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ultimate Carousel For Divi plugin versions = 4.3.0. Solution Update the WordPress Ultimate Carousel For Divi plugin to the latest available version at least 4.3.1...