Description

WordPress Plugin Slideshow is prone to multiple cross-site scripting and information disclosure vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, to steal cookie-based authentication credentials or to obtain sensitive information which may help in launching further attacks. WordPress Plugin Slideshow version 2.1.12 is vulnerable; other versions may also be affected.

Remediation

Update to plugin version 2.1.16 or latest

References

http://www.securityfocus.com/bid/56090/exploit

http://www.waraxe.us/advisory-92.html

http://packetstormsecurity.com/files/117464/WordPress-Slideshow-2.1.12-Cross-Site-Scripting-Path-Disclosure.html

Related Vulnerabilities

Oracle Application Server CVE-2010-0070 Vulnerability (CVE-2010-0070)

WordPress Plugin Image Export Arbitrary File Download (1.1.0)

Django Improper Input Validation Vulnerability (CVE-2023-31047)

MySQL CVE-2019-2626 Vulnerability (CVE-2019-2626)

WordPress Plugin Websimon Tables Cross-Site Scripting (1.3.4)

Severity

High

Classification

CWE-79 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Information Disclosure XSS