Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

610 results · page 12 of 13

Jul 28, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.CVE-2022-35882 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.
Affected
up to 1.9.5
What to do
Affects up to 1.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 27, 2022Authenticated (contributor or higher user role) Cross-Site Scripting (XSS) vulnerability in Nico Amarilla's BxSlider WP plugin <= 2.0.0 at WordPress.CVE-2022-33943 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (contributor or higher user role) Cross-Site Scripting (XSS) vulnerability in Nico Amarilla's BxSlider WP plugin <= 2.0.0 at WordPress.
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 18, 2022The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to properly check for the CVE-2022-2223 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to properly check for the existence of a nonce in the function ewic_duplicate_slider. This make it possible for unauthenticated attackers to duplicate existing posts or pages granted they can trick a site administrator into performing an action such as clicking on a link.
Affected
up to 1.1.121
What to do
Affects up to 1.1.121. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 4, 2022WP Contact Slider: Does not sanitize and escape the Text to Display settings of slidersCVE-2022-1301 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow high privileged users such as editor and above to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
WP Contact Slider
Fixed in
2.4.7
What to do
Update WP Contact Slider to 2.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2022WP Zillow Review Slider: Does not escape a settingsCVE-2022-1915 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Zillow Review Slider WordPress plugin before 2.4 does not escape a settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite)
Product
WP Zillow Review Slider
Fixed in
2.4
What to do
Update WP Zillow Review Slider to 2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2022Post Grid, Slider & Carousel Ultimate: Does not sanitise and escape the Header TitleCVE-2022-1266 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Post Grid, Slider & Carousel Ultimate
Fixed in
1.5.0
What to do
Update Post Grid, Slider & Carousel Ultimate to 1.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 15, 2022Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Xakuro's XO Slider plugin <= 3.3.2 at WordPress.CVE-2022-32280 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Xakuro's XO Slider plugin <= 3.3.2 at WordPress.
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jun 15, 2022Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Promotion Slider plugin <= 3.3.4 at WordPress.CVE-2022-29440 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Promotion Slider plugin <= 3.3.4 at WordPress.
Affected
up to 3.3.4
What to do
Affects up to 3.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jun 15, 2022Image Slider by NextCode plugin <= 1.1.2 at: Cross-Site Request Forgery (CSRF)CVE-2022-29439 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress allows deleting slides.
Product
Image Slider by NextCode plugin <= 1.1.2 at
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Image Slider by NextCode plugin <= 1.1.2 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jun 15, 2022Authenticated (author or higher user role) Persistent Cross-Site Scripting (XSS) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress.CVE-2022-29438 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Persistent Cross-Site Scripting (XSS) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress.
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jun 15, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Image Slider by NextCode plugin <= 1.1.2 at WordPress.CVE-2022-29437 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Image Slider by NextCode plugin <= 1.1.2 at WordPress.
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jun 8, 2022Logo Slider: Does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement via the Manage Slider Images admin pageCVE-2022-1687 · WordPress plugins & themes · reported by WPScanLow 2.7
The Logo Slider WordPress plugin through 1.4.8 does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement via the Manage Slider Images admin page, leading to an SQL Injection
Product
Logo Slider
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Logo Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Jun 8, 2022Cube Slider: Does not sanitise and escape the idslider parameter before using it in various SQL queriesCVE-2022-1684 · WordPress plugins & themes · reported by WPScanLow 2.7
The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin
Product
Cube Slider
Affected
up to 1.2
What to do
Affects up to 1.2. Update Cube Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Jun 8, 2022Video Slider: Does not sanitize or escape some of its video settingsCVE-2022-1541 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Slider WordPress plugin before 1.4.8 does not sanitize or escape some of its video settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Video Slider
Fixed in
1.4.8
What to do
Update Video Slider to 1.4.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2022Sliderby10Web: Does not properly sanitize and escape some of its settingsCVE-2022-1320 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Sliderby10Web
Fixed in
1.2.52
What to do
Update Sliderby10Web to 1.2.52 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 20, 2022Cross-Site Scripting (XSS) vulnerability in Muneeb's WP Slider Plugin <= 1.4.5 at WordPress.CVE-2022-29428 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Cross-Site Scripting (XSS) vulnerability in Muneeb's WP Slider Plugin <= 1.4.5 at WordPress.
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
May 20, 2022Authenticated (contributor or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in 2J Slideshow Team's Slideshow, Image Slider by 2J plugin <CVE-2022-29426 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (contributor or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in 2J Slideshow Team's Slideshow, Image Slider by 2J plugin <= 1.3.54 at WordPress.
Affected
up to 1.3.54
What to do
Affects up to 1.3.54. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
May 9, 2022Slide Anything: Does not sanitize and escape sliders' descriptionCVE-2022-1303 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slide Anything WordPress plugin before 2.3.44 does not sanitize and escape sliders' description, which could allow high privilege users such as editor and above to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
Slide Anything
Fixed in
2.3.44
What to do
Update Slide Anything to 2.3.44 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022LayerSlider: Does not sanitise and escape Project's slug before outputting it back in various placeCVE-2022-1153 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
LayerSlider
Fixed in
7.1.2
What to do
Update LayerSlider to 7.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 13, 2022Yooslider Yoo Slider <= 2.0.0 on: Cross-Site Request Forgery (CSRF)CVE-2022-27847 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to import templates.
Product
Yooslider Yoo Slider <= 2.0.0 on
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Yooslider Yoo Slider <= 2.0.0 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 13, 2022Yooslider Yoo Slider <= 2.0.0 on: Cross-Site Request Forgery (CSRF)CVE-2022-27846 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to create or modify slider.
Product
Yooslider Yoo Slider <= 2.0.0 on
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Yooslider Yoo Slider <= 2.0.0 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 4, 2022Web-Settler Testimonial Slider – Free Testimonials Slider: Authenticated (editor or higher user role) Cross-Site Scripting (XSS)CVE-2021-36851 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated (editor or higher user role) Cross-Site Scripting (XSS) vulnerability in Web-Settler Testimonial Slider – Free Testimonials Slider Plugin (WordPress plugin) via parameters mpsp_posts_bg_color, mpsp_posts_description_color, mpsp_slide_nav_button_color.
Product
Web-Settler Testimonial Slider – Free Testimonials Slider
Affected
up to 3.5.8.3
What to do
Affects up to 3.5.8.3. Update Web-Settler Testimonial Slider – Free Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 23, 2022Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to injectCVE-2022-25609 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to inject the malicious code.
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 23, 2022Cross-Site Request Forgery (CSRF) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers to trick authenticated users into unwanted sliCVE-2022-25608 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers to trick authenticated users into unwanted slider duplicate or delete action.
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 14, 2022Team Circle Image Slider With Lightbox: Does not sanitize and escape the order_pos parameter before outputting it back in an admin pageCVE-2022-0648 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Team Circle Image Slider With Lightbox
Fixed in
1.0.16
What to do
Update Team Circle Image Slider With Lightbox to 1.0.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022WP Review Slider: Does not sanitise and escape the pid parameterCVE-2022-0383 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Review Slider WordPress plugin before 11.0 does not sanitise and escape the pid parameter when copying a Twitter source, which could allow a high privilege users to perform SQL Injections attacks
Product
WP Review Slider
Fixed in
11.0
What to do
Update WP Review Slider to 11.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022Logo Showcase with Slick Slider: Does not have CSRF check in the lswss_save_attachment_data AJAX actionCVE-2021-24913 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media.
Product
Logo Showcase with Slick Slider
Fixed in
2.0.1
What to do
Update Logo Showcase with Slick Slider to 2.0.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022Logo Showcase with Slick Slider: Does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX actionCVE-2021-24730 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media.
Product
Logo Showcase with Slick Slider
Fixed in
1.2.5
What to do
Update Logo Showcase with Slick Slider to 1.2.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 23, 2021Logo Showcase with Slick Slider: Does not sanitise the Grid SettingsCVE-2021-24729 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase.
Product
Logo Showcase with Slick Slider
Fixed in
1.2.4
What to do
Update Logo Showcase with Slick Slider to 1.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Logo Slider and Showcase: Allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability checkCVE-2021-24742 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability check.
Product
Logo Slider and Showcase
Fixed in
1.3.37
What to do
Update Logo Slider and Showcase to 1.3.37 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Content text slider on post: Does not sanitise and escape the Title and Message/Content settingsCVE-2015-20019 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content settings, which could lead to Cross-Site Scripting issues
Product
Content text slider on post
Fixed in
6.9
What to do
Update Content text slider on post to 6.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org seclists.org
Oct 25, 2021Responsive WordPress Slider: Does not sanitise and escape some of the Slider optionsCVE-2021-24544 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive WordPress Slider WordPress plugin through 2.2.0 does not sanitise and escape some of the Slider options, allowing Cross-Site Scripting payloads to be set in them. Furthermore, as by default any authenticated user is allowed to create Sliders (https://wordpress.org/support/topic/slider-can-be-changed-from-any-user-even-subscriber/, such settings can be changed in the plugin's settings), this would allow user with a role as low as subscriber to perform Cross-Site Scripting attacks against logged in admins viewing the slider list and could lead to privilege escalation by creating a rogue admin account for example.
Product
Responsive WordPress Slider
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Responsive WordPress Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as lCVE-2021-24640 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
Product
WordPress Slider Block Gutenslider
Fixed in
5.2.0
What to do
Update WordPress Slider Block Gutenslider to 5.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Add new scene functionality in the Responsive 3D Slider: Uses an id parameterCVE-2021-24398 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Add new scene functionality in the Responsive 3D Slider WordPress plugin through 1.2 uses an id parameter which is not sanitised, escaped or validated before being inserted to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 seconds it takes 10 seconds to return since the query is ran twice.
Product
Add new scene functionality in the Responsive 3D Slider
Affected
up to 1.2
What to do
Affects up to 1.2. Update Add new scene functionality in the Responsive 3D Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 23, 2021The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, thereCVE-2021-24557 · WordPress plugins & themes · reported by WPScanHigh 7.2
The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role.
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 23, 2021Slider Hero with Animation, Video Background & Intro Maker: Does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statementCVE-2021-24506 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users with a role as low as Contributor to perform SQL injection.
Product
Slider Hero with Animation, Video Background & Intro Maker
Fixed in
8.2.7
What to do
Update Slider Hero with Animation, Video Background & Intro Maker to 8.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021slider import search feature and tab parameter of the Post Grid: Settings are not properly sanitised before being output back in the pagesCVE-2021-24488 · WordPress plugins & themes · reported by WPScanMedium 6.1
The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues
Product
slider import search feature and tab parameter of the Post Grid
Fixed in
2.1.8
What to do
Update slider import search feature and tab parameter of the Post Grid to 2.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24463 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin before 2.5.0 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
Product
get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel
Fixed in
2.5.0
What to do
Update get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 14, 2021The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored CrCVE-2021-24382 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed.
Fixed in
3.5.0.9
What to do
Update the plugin to 3.5.0.9 or newer.
Full record and what to do →NVD record smartslider.helpscoutdocs.com wpscan.com
May 24, 2021slider import search feature of the PickPlugins Product Slider for WooCommerce: Did not properly sanitised the keyword GET parameterCVE-2021-24300 · WordPress plugins & themes · reported by WPScanMedium 6.1
The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue
Product
slider import search feature of the PickPlugins Product Slider for WooCommerce
Fixed in
1.13.22
What to do
Update slider import search feature of the PickPlugins Product Slider for WooCommerce to 1.13.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 5, 2021Social Slider Widget: Allowed Authenticated Reflected XSS in the plugin settings pageCVE-2021-24196 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized
Product
Social Slider Widget
Fixed in
1.8.5
What to do
Update Social Slider Widget to 1.8.5 or newer.
Full record and what to do →NVD record purinechu.github.io wpscan.com
Mar 18, 2021The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plugin were vulnerable, CVE-2021-24132 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plugin were vulnerable, allowing a high privileged user (Admin), or medium one such as Contributor+ (if "Role Options" is turn on for other users) to perform a SQL Injection attacks.
Fixed in
1.2.36
What to do
Update the plugin to 1.2.36 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2020A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin.CVE-2020-11530 · WordPress plugins & themes · reported by MITRECritical 9.8
A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter supplied to get_script/index.php, and allows an attacker to execute arbitrary SQL queries in the context of the WP database user.
Affected
3.0 to 3.0
What to do
Affects 3.0 to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Feb 8, 2020Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SCVE-2015-2062 · WordPress plugins & themes · reported by MITREHigh 7.2
Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SQL commands via the removeslide parameter in a popup_posts or edit_cat action in the sliders_huge_it_slider page to wp-admin/admin.php.
Product
Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image)
Fixed in
2.7.0
What to do
Update Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) to 2.7.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 7, 2019The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.CVE-2015-9454 · WordPress plugins & themes · reported by MITREHigh 8.8
The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.
Product
smooth-slider
Fixed in
2.7
What to do
Update smooth-slider to 2.7 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section.CVE-2015-9419 · WordPress plugins & themes · reported by MITREMedium 6.1
The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section.
Affected
1.0.6 to 1.0.6
What to do
Affects 1.0.6 to 1.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.CVE-2015-9417 · WordPress plugins & themes · reported by MITREMedium 6.5
The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.
Product
testimonial-slider
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update testimonial-slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 25, 2019The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.CVE-2015-9412 · WordPress plugins & themes · reported by MITREMedium 6.1
The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.
Product
Royal-Slider
Fixed in
3.2.7
What to do
Update Royal-Slider to 3.2.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 3, 2019The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.CVE-2019-15866 · WordPress plugins & themes · reported by MITREHigh 8.8
The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.
Product
crelly-slider
Fixed in
1.3.5
What to do
Update crelly-slider to 1.3.5 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Dec 22, 2018The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.CVE-2018-20368 · WordPress plugins & themes · reported by MITREMedium 5.4
The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.