Lucene search
Fayçal CHENAWPVDB-ID:CFC80857-8674-478F-9604-7A8849E5B85EHistoryMay 18, 2022 - 12:00 a.m.
Slideshow CK < 1.4.10 - Admin+ Stored Cross-Site Scripting
2022-05-1800:00:00
Fayçal CHENA
wpscan.com
6
0.001 Low
EPSS
Percentile
24.8%
The plugin does not sanitize and escape Slide’s descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
PoC
Create/edit a Slideshow, add a Slide and put the following payload in the Description The XSS will be triggered in page/post where the Slideshow is embed
| CPE | Name | Operator | Version |
|---|---|---|---|
| slideshow-ck | lt | 1.4.10 |
Related
cnvd
cnvd
WordPress Slideshow CK plugin跨站脚本漏洞
2022-06-15 00:00:00
cvelist
cvelist
CVE-2022-1335 Slideshow CK < 1.4.10 - Admin+ Stored Cross-Site Scripting
2022-06-13 12:41:44
patchstack
patchstack
cve
cve
CVE-2022-1335
2022-06-13 13:15:10
prion
prion
Cross site scripting
2022-06-13 13:15:00
nvd
nvd
CVE-2022-1335
2022-06-13 13:15:10
wpexploit
wpexploit
Slideshow CK < 1.4.10 - Admin+ Stored Cross-Site Scripting
2022-05-18 00:00:00