Smart Slider 3 < 3.5.1.38 - Contributor+ Sensitive Information Exposure via keyword Parameter

Description

The plugin is vulnerable to Sensitive Information Exposure via the 'keyword' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract titles and full content excerpts of private, draft, pending, trashed, and auto-draft posts authored by any user, including Administrators and Editors. The required nonce is emitted on /wp-admin/post-new.php, which is accessible to Contributor-level users via the edit_posts capability, meaning any Contributor can obtain the nonce needed to trigger the injection.