CVE-2022-2413

Slide Anything < 2.3.47 - Author+ Cross Site Scripting in slide title

Medium · published January 16, 2024

CVSS v3.1
5.4
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript payload into the slide title even when the unfiltered_html capability is disabled.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00530 · 44.0th percentile
Published
2024-01-16T15:49Z
EPSS history
Timeline
  • 16 JAN 15:49Z
    Slide Anything < 2.3.47 - Author+ Cross Site Scripting in slide title
    cvelistv5