Riskcovery

CVE-2021-24382

Smart Slider 3 < 3.5.0.9 - Authenticated Stored Cross-Site Scripting (XSS)

State
Published
Severity
Not scored
Published
Jun 14, 2021
Updated
Aug 3, 2024
Reserved
Jan 14, 2021

Read the record on cve.org

Description

The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-79 Cross-site Scripting (XSS)

Affected Products

ProductVersions
Smart Slider 3Nextend
  • 3.5.0.9 to before 3.5.0.9Affected
Smart Slider 3Nextend
  • 3.5.0.9 to before 3.5.0.9Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.