Carousel Slider < 2.2.10 – Editor+ Stored XSS | CVE 2024-3703 | Plugin Vulnerabilities

Description

The plugin does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embed, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks

Proof of Concept

As an Editor, create/edit a Slider, add a slide and put the following payload in any of the Slider Padding settings (such as Top, Bottom, Left, Right):  "onmouseover=alert(/XSS/)

Save and put the Slider Shortcode in a page/post, view it and move the mouse over the generated slides to trigger the XSS

Affects Plugins

carousel-slider

Fixed in 2.2.10

References

CVE

URL

https://research.cleantalk.org/cve-2024-3703/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Krugov Artyom

Submitter

Krugov Aryom

Submitter website

https://research.cleantalk.org

Verified

Yes

WPVDB ID

3242b820-1da0-41ba-9f35-7be5dbc6d4b0

Timeline

Publicly Published

2024-04-12 (about 1 year ago)

Added

2024-04-12 (about 1 year ago)

Last Updated

2024-04-12 (about 1 year ago)

Other

Published

Title

Published

2024-03-28

Title

Limit Attempts by BestWebSoft < 1.3.0 - Reflected Cross-Site Scripting

Published

2025-09-26

Title

Silencesoft RSS Reader <= 0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2025-11-09

Title

Travelers' Map < 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-06-25

Title

WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) < 3.3.0 - Unauthenticated Stored Cross-Site Scripting via Client-IP header

Published

2021-10-15

Title

Indeed Job Importer <= 1.0.5 - Admin+ Stored Cross-Site Scripting