Lucene search
Dmitrii IgnatyevWPEX-ID:13DCFD8A-E378-44B4-AF6F-940BC41539A4HistoryMay 01, 2024 - 12:00 a.m.
Carousel Slider < 2.2.11 - Editor+ Stored XSS
2024-05-0100:00:00
Dmitrii Ignatyev
20
xss
poc
update
exploit
Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks
1. Create a new slider and inset: (1212"onmouseover='alert(1)') to "URL View" field.References
Related
cvelist
cvelist
CVE-2024-4372 Carousel Slider < 2.2.11 - Editor+ Stored XSS
2024-05-21 06:00:02
nvd
nvd
CVE-2024-4372
2024-05-21 06:15:10
cve
cve
CVE-2024-4372
2024-05-21 06:15:10
vulnrichment
vulnrichment
CVE-2024-4372 Carousel Slider < 2.2.11 - Editor+ Stored XSS
2024-05-21 06:00:02
wpvulndb
wpvulndb
Carousel Slider < 2.2.11 - Editor+ Stored XSS
2024-05-01 00:00:00
wordfence
wordfence
6.1 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.1%
Related for WPEX-ID:13DCFD8A-E378-44B4-AF6F-940BC41539A4