WordPress Plugin Vulnerabilities
Master Slider < 3.7.1 - Authenticated Stored Cross-Site Scripting (XSS)
Description
The plugin did not properly sanitise the slider name when creating or editing a slider, leading to an Authenticated (editor+) Stored Cross-Site Scripting issue which will be triggered in the Slider table (/wp-admin/admin.php?page=master-slider).
Edit (WPScanTeam):
- The original report was from 2018, however the issue was never remediated.
- Multiple attempts were made to contact the vendor, but no response was received
- April 28th, 2021, v3.7.1 released, fixing the issue
Proof of Concept
Affects Plugins
References
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Vulnerability-Lab
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2018-11-14 (about 7 years ago)
Added
2021-04-09 (about 5 years ago)
Last Updated
2021-04-28 (about 5 years ago)