Lucene search
Dmitrii IgnatyevWPVDB-ID:13DCFD8A-E378-44B4-AF6F-940BC41539A4HistoryMay 01, 2024 - 12:00 a.m.
Carousel Slider < 2.2.11 - Editor+ Stored XSS
2024-05-0100:00:00
Dmitrii Ignatyev
wpscan.com
3
cross-site scripting
plugin vulnerability
user role
Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks
PoC
1. Create a new slider and inset: (1212"onmouseover=‘alert(1)’) to “URL View” field.
| CPE | Name | Operator | Version |
|---|---|---|---|
| eq | 2.2.11 |
References
Related
cvelist
cvelist
CVE-2024-4372 Carousel Slider < 2.2.11 - Editor+ Stored XSS
2024-05-21 06:00:02
nvd
nvd
CVE-2024-4372
2024-05-21 06:15:10
cve
cve
CVE-2024-4372
2024-05-21 06:15:10
vulnrichment
vulnrichment
CVE-2024-4372 Carousel Slider < 2.2.11 - Editor+ Stored XSS
2024-05-21 06:00:02
wpexploit
wpexploit
Carousel Slider < 2.2.11 - Editor+ Stored XSS
2024-05-01 00:00:00
wordfence
wordfence
5.8 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.1%
Related for WPVDB-ID:13DCFD8A-E378-44B4-AF6F-940BC41539A4