Cross-Site Scripting in Master Slider Plugin for WordPress by Magenest
CVE-2018-20368

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Master Slider
Vendor
CVE Published:
23 December 2018

Summary

The Master Slider plugin for WordPress, specifically versions 3.2.7 and 3.5.1, is susceptible to a Cross-Site Scripting (XSS) vulnerability. This security flaw arises due to improper handling of user input through the wp-admin/admin-ajax.php endpoint. An attacker can exploit this vulnerability by injecting malicious scripts via the Name input field within the MSPanel.Settings configuration, potentially allowing unauthorized access and control over affected installations.

References

https://www.vulnerability-lab.com/get_content.php?id=2158
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.