WordPress Plugin Vulnerabilities

Master Slider < 3.7.1 - Authenticated Stored Cross-Site Scripting (XSS)

Description

The plugin did not properly sanitise the slider name when creating or editing a slider, leading to an Authenticated (editor+) Stored Cross-Site Scripting issue which will be triggered in the Slider table (/wp-admin/admin.php?page=master-slider).

Edit (WPScanTeam):
- The original report was from 2018, however the issue was never remediated.
- Multiple attempts were made to contact the vendor, but no response was received
- April 28th, 2021, v3.7.1 released, fixing the issue

Proof of Concept

Affects Plugins

Fixed in 3.7.1

References

Classification

Type
XSS
CWE

Miscellaneous

Original Researcher
Vulnerability-Lab
Verified
Yes

Timeline

Publicly Published
2018-11-14 (about 7 years ago)
Added
2021-04-09 (about 5 years ago)
Last Updated
2021-04-28 (about 5 years ago)

Other