WordPress Plugin Vulnerabilities

Post Sliders & Post Grids < 1.0.21 - Admin+ Stored XSS

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affects Plugins

Plugin icon
post-slider-carousel
Fixed in 1.0.21

References

CVE
CVE-2023-47226
URL
https://patchstack.com/database/vulnerability/post-slider-carousel/wordpress-post-sliders-post-grids-plugin-1-0-20-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
yuyudhn
Verified
No
WPVDB ID
103d7bf9-9a28-40e0-bd0c-7bcfc9a2f054

Timeline

Publicly Published
2023-11-03 (about 2 years ago)
Added
2023-11-23 (about 2 years ago)
Last Updated
2024-04-03 (about 2 years ago)

Other

Published
Title
Published
2023-02-15
Title
WordPress Social Login and Register < 7.5.15 - Multiple CSRF
Published
2024-11-19
Title
Restaurant Menu – Food Ordering System – Table Reservation < 2.4.3 - Reflected Cross-Site Scripting
Published
2025-12-27
Title
WC Builder < 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2021-07-08
Title
Grow Social < 1.19.0 - Reflected Cross-Site Scripting
Published
2025-12-06
Title
Advanced FAQ Manager < 1.5.3 - Authenticated (Author+) Stored Cross-Site Scripting