Vulnerability · Published Jun 14, 2021 · Assigned by WPScan
CVE-2021-24382Smart Slider 3 < 3.5.0.9 - Authenticated Stored Cross-Site Scripting (XSS)
Medium 5.4
In plain English
A medium-severity cross-site scripting in Smart Slider 3 from Nextend. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Official description
The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Nextend | Smart Slider 3 | 3.5.0.9 – before 3.5.0.9 |
| Nextend | Smart Slider 3 | 3.5.0.9 – before 3.5.0.9 |
Weakness: CWE-79
References
- https://wpscan.com/vulnerability/7b32a282-e51f-4ee5-b59f-5ba10e62a54d x_refsource_CONFIRM
- https://smartslider.helpscoutdocs.com/article/1746-changelog x_refsource_MISC