Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

610 results · page 7 of 13

Dec 14, 2024Wp photo text slider 50: Stored Cross-Site ScriptingCVE-2024-11884 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Wp photo text slider 50 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-photo-slider' shortcode in all versions up to, and including, 8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Wp photo text slider 50
Affected
up to 8.1
What to do
Affects up to 8.1. Update Wp photo text slider 50 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 14, 2024Post Carousel & Slider: Stored Cross-Site ScriptingCVE-2024-11770 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Carousel & Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'post-cs' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Carousel & Slider
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Post Carousel & Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2024Slider Pro: Missing AuthorizationCVE-2023-41865 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bqworks Slider Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider Pro: from n/a through 4.8.6.
Product
Slider Pro
Affected
up to 4.8.6
What to do
Affects up to 4.8.6. Update Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Carousel Slider: Missing AuthorizationCVE-2023-41848 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Majeed Raza Carousel Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Carousel Slider: from n/a through 2.2.2.
Product
Carousel Slider
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Carousel Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Category Slider for WooCommerce: Missing AuthorizationCVE-2023-41132 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ShapedPlugin LLC Category Slider for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Category Slider for WooCommerce: from n/a through 1.4.15.
Product
Category Slider for WooCommerce
Affected
up to 1.4.15
What to do
Affects up to 1.4.15. Update Category Slider for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Accordion Slider: Missing AuthorizationCVE-2023-40331 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bqworks Accordion Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion Slider: from n/a through 1.9.6.
Product
Accordion Slider
Affected
up to 1.9.6
What to do
Affects up to 1.9.6. Update Accordion Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Accordion and Accordion Slider: Missing AuthorizationCVE-2023-39996 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Accordion and Accordion Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion and Accordion Slider: from n/a through 1.2.4.
Product
Accordion and Accordion Slider
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Accordion and Accordion Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Easing Slider: Missing AuthorizationCVE-2023-30490 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Matthew Ruddy Easing Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easing Slider : from n/a through 3.0.8.
Product
Easing Slider
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Easing Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Depicter Slider: Missing AuthorizationCVE-2022-47176 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Depicter Slider and Popup by Averta Depicter Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through 1.9.0.
Product
Depicter Slider
Affected
up to 1.9.0
What to do
Affects up to 1.9.0. Update Depicter Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Trending/Popular Post Slider and Widget: Missing AuthorizationCVE-2022-46846 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Trending/Popular Post Slider and Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trending/Popular Post Slider and Widget: from n/a through 1.5.7.
Product
Trending/Popular Post Slider and Widget
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update Trending/Popular Post Slider and Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 12, 2024Product Carousel Slider & Grid Ultimate for WooCommerce: Local File InclusionCVE-2024-12040 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.10 via the 'theme' attribute of the `wcpcsu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Product Carousel Slider & Grid Ultimate for WooCommerce
Affected
up to 1.9.10
What to do
Affects up to 1.9.10. Update Product Carousel Slider & Grid Ultimate for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more: Stored Cross-Site ScriptingCVE-2024-11766 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gs_book_showcase' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more: Stored Cross-Site ScriptingCVE-2024-11765 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gs_portfolio' shortcode in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 9, 2024Meta slider and carousel with lightbox: Missing AuthorizationCVE-2023-25703 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Meta slider and carousel with lightbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta slider and carousel with lightbox: from n/a through 1.6.2.
Product
Meta slider and carousel with lightbox
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Meta slider and carousel with lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024Slider and Carousel slider by Depicter: Stored Cross-Site ScriptingCVE-2024-4633 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘addExtraMimeType’ function in versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slider and Carousel slider by Depicter
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Slider and Carousel slider by Depicter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 2, 2024Infinite Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52461 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kinsta Infinite Slider infinite-slider allows Reflected XSS.This issue affects Infinite Slider: from n/a through <= 2.0.1.
Product
Infinite Slider
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Infinite Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 1, 2024Post Carousel Slider for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53749 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Devs Post Carousel Slider for Elementor post-carousel-slider-for-elementor allows Stored XSS.This issue affects Post Carousel Slider for Elementor: from n/a through <= 1.5.0.
Product
Post Carousel Slider for Elementor
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Post Carousel Slider for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 28, 2024Logo Slider: Does not sanitise and escape some of its Logo and Slider settingsCVE-2024-10896 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo and Slider settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting
Product
Logo Slider
Fixed in
4.5.0
What to do
Update Logo Slider to 4.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 28, 2024Logo Slider: Does not sanitise and escape some of its Logo SettingsCVE-2024-10473 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo Settings when outputing them in pages where the Logo Slider shortcode is embed, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks.
Product
Logo Slider
Fixed in
4.5.0
What to do
Update Logo Slider to 4.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 25, 2024Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its Images settingsCVE-2024-6393 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Photo Gallery, Sliders, Proofing and
Fixed in
3.59.5
What to do
Update Photo Gallery, Sliders, Proofing and to 3.59.5 or newer.
Full record and what to do →NVD record wpscan.com
Nov 22, 2024Tribute Testimonials – WordPress Testimonial Grid/Slider: Stored Cross-Site ScriptingCVE-2024-10886 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tribute Testimonials – WordPress Testimonial Grid/Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tribute_testimonials_slider' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Tribute Testimonials – WordPress Testimonial Grid/Slider
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Tribute Testimonials – WordPress Testimonial Grid/Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2024The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery) plugin foCVE-2024-11601 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the save_options() function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Please note this is limited to option values that can be saved as arrays.
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2024The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plugin for WordPress isCVE-2024-11104 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the save_options() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. Please note this is limited to option values that can be saved as arrays.
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 19, 2024Kings Tab Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51932 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saif Kings Tab Slider kings-tab-slider allows DOM-Based XSS.This issue affects Kings Tab Slider: from n/a through <= 1.0.
Product
Kings Tab Slider
Affected
up to 1.0
What to do
Affects up to 1.0. Update Kings Tab Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Testimonial Slider Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51925 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sazzad Testimonial Slider Shortcode testimonial-slider-shortcode allows Stored XSS.This issue affects Testimonial Slider Shortcode: from n/a through <= 1.1.9.
Product
Testimonial Slider Shortcode
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Testimonial Slider Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Magic Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51896 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Magic Slider magic-slider allows Stored XSS.This issue affects Magic Slider: from n/a through <= 1.3.
Product
Magic Slider
Affected
up to 1.3
What to do
Affects up to 1.3. Update Magic Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024NV Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51887 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ryscript NV Slider nv-slider allows Stored XSS.This issue affects NV Slider: from n/a through <= 1.6.
Product
NV Slider
Affected
up to 1.6
What to do
Affects up to 1.6. Update NV Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Luzuk Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51834 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in luzuk Themes Luzuk Slider luzuk-slider allows Stored XSS.This issue affects Luzuk Slider: from n/a through <= 0.1.5.
Product
Luzuk Slider
Affected
up to 0.1.5
What to do
Affects up to 0.1.5. Update Luzuk Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 18, 2024OS BXSlider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52342 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS BXSlider os-bxslider allows Stored XSS.This issue affects OS BXSlider: from n/a through <= 2.6.
Product
OS BXSlider
Affected
up to 2.6
What to do
Affects up to 2.6. Update OS BXSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 16, 2024B-Banner Slider: Unrestricted Upload of File with Dangerous TypeCVE-2024-52405 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in bikramjoshii B-Banner Slider b-banner-slider allows Upload a Web Shell to a Web Server.This issue affects B-Banner Slider: from n/a through <= 1.1.
Product
B-Banner Slider
Affected
up to 1.1
What to do
Affects up to 1.1. Update B-Banner Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 12, 2024Social Proof (Testimonial) Slider: Stored Cross-Site ScriptingCVE-2024-8985 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Social Proof (Testimonial) Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's spslider-block shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Social Proof (Testimonial) Slider
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Social Proof (Testimonial) Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 9, 2024Team Showcase and Slider – Team Members Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51763 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in biplob018 Team Showcase and Slider – Team Members Builder team-showcase-ultimate allows Reflected XSS.This issue affects Team Showcase and Slider – Team Members Builder: from n/a through <= 1.3.
Product
Team Showcase and Slider – Team Members Builder
Affected
up to 1.3
What to do
Affects up to 1.3. Update Team Showcase and Slider – Team Members Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Content Slider Block: Information ExposureCVE-2024-10667 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Content Slider Block plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1.5 via the [csb] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Content Slider Block
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Content Slider Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2024Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider): Stored Cross-Site ScriptingCVE-2024-8442 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Blog widget in all versions up to, and including, 3.15.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider)
Affected
up to 3.15.18
What to do
Affects up to 3.15.18. Update Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 1, 2024Depicter Slider: Cross-Site Request Forgery (CSRF)CVE-2024-47359 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in averta Depicter Slider depicter.This issue affects Depicter Slider: from n/a through <= 3.2.2.
Product
Depicter Slider
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Depicter Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Social Slider Feed: Missing AuthorizationCVE-2024-43215 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in creativemotion Social Slider Feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Slider Feed: from n/a through 2.2.2.
Product
Social Slider Feed
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Social Slider Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Banner Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49635 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in manjurul.cis Banner Slider banner-slider allows Reflected XSS.This issue affects Banner Slider: from n/a through <= 2.1.
Product
Banner Slider
Affected
up to 2.1
What to do
Affects up to 2.1. Update Banner Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Apa Banner Slider: Cross-Site Request Forgery (CSRF)CVE-2024-49622 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari Apa Banner Slider apa-banner-slider allows SQL Injection.This issue affects Apa Banner Slider: from n/a through <= 1.0.0.
Product
Apa Banner Slider
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Apa Banner Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024jLayer Parallax Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49334 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unizoe Web Solutions jLayer Parallax Slider jlayer-parallax-slider-wp allows Reflected XSS.This issue affects jLayer Parallax Slider: from n/a through <= 1.0.
Product
jLayer Parallax Slider
Affected
up to 1.0
What to do
Affects up to 1.0. Update jLayer Parallax Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024All in One Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49323 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahriar Alam All in One Slider all-in-one-slider allows Reflected XSS.This issue affects All in One Slider: from n/a through <= 1.1.
Product
All in One Slider
Affected
up to 1.1
What to do
Affects up to 1.1. Update All in One Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Lightbox slider – Responsive Lightbox Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49280 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weblizar - WordPress Themes & Plugin Lightbox slider – Responsive Lightbox Gallery simple-lightbox-gallery allows Stored XSS.This issue affects Lightbox slider – Responsive Lightbox Gallery: from n/a through <= 1.10.6.
Product
Lightbox slider – Responsive Lightbox Gallery
Affected
up to 1.10.6
What to do
Affects up to 1.10.6. Update Lightbox slider – Responsive Lightbox Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024cSlider: Cross-Site Request Forgery (CSRF)CVE-2024-49221 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in julian.weinert cSlider cslider allows Cross Site Request Forgery.This issue affects cSlider: from n/a through <= 2.4.2.
Product
cSlider
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update cSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Logo Slider: Does not validate and escape some of its Slider Settings before outputting them back in attributesCVE-2024-5429 · WordPress plugins & themes · reported by WPScanHigh 7.6
The Logo Slider WordPress plugin before 4.1.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Logo Slider
Fixed in
4.1.0
What to do
Update Logo Slider to 4.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2024MaxSlider: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-47351 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The CSSIgniter Team MaxSlider maxslider allows Path Traversal.This issue affects MaxSlider: from n/a through <= 1.2.3.
Product
MaxSlider
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update MaxSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Accordion Slider: Stored Cross-Site ScriptingCVE-2024-9582 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Accordion Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ attribute of an accordion slider in all versions up to, and including, 1.9.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Successful exploitation by Contributor-level users requires an Administrator-level user to provide access to the plugin's admin area via the `Access` plugin setting, which is restricted to administrators by default.
Product
Accordion Slider
Affected
up to 1.9.11
What to do
Affects up to 1.9.11. Update Accordion Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 8, 2024Photo Gallery, Images, Slider in Rbs Image Gallery: Unauthorized access of dataCVE-2024-8431 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajaxGetGalleryJson() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve private post titles.
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Affected
up to 3.2.21
What to do
Affects up to 3.2.21. Update Photo Gallery, Images, Slider in Rbs Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 6, 2024Meta slider and carousel with lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47307 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Essential Plugin Meta slider and carousel with lightbox meta-slider-and-carousel-with-lightbox allows Stored XSS.This issue affects Meta slider and carousel with lightbox: from n/a through <= 2.0.1.
Product
Meta slider and carousel with lightbox
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Meta slider and carousel with lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Depicter Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47381 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Depicter Slider depicter allows Stored XSS.This issue affects Depicter Slider: from n/a through <= 3.2.2.
Product
Depicter Slider
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Depicter Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2024XO Slider: Stored Cross-Site ScriptingCVE-2024-8324 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The XO Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘get_slider’ function in all versions up to, and including, 3.8.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
XO Slider
Affected
up to 3.8.6
What to do
Affects up to 3.8.6. Update XO Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2024Slider Revolution: Stored Cross-Site ScriptingCVE-2024-8107 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. By default, this can only be exploited by administrators, but the ability to use and configure Slider Revolution can be extended to authors.
Product
Slider Revolution
Affected
up to 6.7.18
What to do
Affects up to 6.7.18. Update Slider Revolution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record sliderrevolution.com sliderrevolution.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.