CVE Vulnerability

CVE-2021-24382

The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://wpscan.com/vulnerability/7b32a282-e51f-4ee5-b59f-5ba10e62a54d Exploit Third Party Advisory
https://smartslider.helpscoutdocs.com/article/1746-changelog Patch Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:nextendweb:smart_slider:*:*:*:*:pro:wordpress:*:*
cpe:2.3:a:nextendweb:smart_slider:*:*:*:*:free:wordpress:*:*
Information

Published : 2021-06-14 02:15

Updated : 2021-06-22 08:09

NVD link : CVE-2021-24382

Mitre link : CVE-2021-24382

Products Affected
No products.
CWE
CWE-79