WordPress Plugin Vulnerabilities

WordPress Vertical Image Slider < 1.2.17 - Reflected Cross-Site Scripting

Description

The plugin does not properly sanitize the 'search_term' parameter, leading to Reflected Cross-Site Scripting vulnerability due to insufficient input sanitization and output escaping.

Affects Plugins

Plugin icon
wp-vertical-image-slider
Fixed in 1.2.17

References

CVE
CVE-2023-2289
URL
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-vertical-image-slider/wordpress-vertical-image-slider-plugin-1216-reflected-cross-site-scripting

Miscellaneous

Original Researcher
Marco Wotschka
Verified
No
WPVDB ID
d2d0390a-ad64-4b7b-9410-34639779a20f

Timeline

Publicly Published
2023-04-25 (about 3 years ago)
Added
2023-06-09 (about 2 years ago)
Last Updated
2023-06-09 (about 2 years ago)

Other

Published
Title
Published
2019-09-02
Title
Event Tickets <= 4.10.7.1 - CSV Injection
Published
2019-11-19
Title
Jetpack 5.1-7.9 - Vulnerability in Shortcode Embed Code
Published
2014-08-01
Title
Method 2.1 - dl-skin.php _mysite_delete_skin_zip Parameter Absolute Path Traversal Remote Directory Deletion
Published
2014-08-01
Title
vTiger - CRM Lead Capture Unspecified
Published
2018-01-27
Title
Enfold Theme < 4.2.1 - Rewrite Portfolio Permalink Structure & Information Disclosure