CVE-2021-24382CWE-79

Smart Slider 3 < 3.5.0.9 - Authenticated Stored Cross-Site Scripting (XSS)

published June 14, 2021

CVSS
—
EPSS
1%
Percentile
51.7
In the wild
Unconfirmed
What it is

The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00676 · 51.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-06-14T13:37Z
EPSS history
Timeline
  • 14 JUN 13:37Z
    Smart Slider 3 < 3.5.0.9 - Authenticated Stored Cross-Site Scripting (XSS)
    cvelistv5