Stored Cross-Site Scripting in Carousel and Slider Plugins for WordPress
CVE-2023-5362
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 30 October 2023
What is CVE-2023-5362?
The Carousel, Recent Post Slider, and Banner Slider plugins for WordPress exhibit a vulnerability that allows authenticated users with contributor-level access or higher to exploit insufficient input sanitization and output escaping via the 'spice_post_slider' shortcode. This leads to the potential for attackers to inject arbitrary web scripts, which will execute whenever a user visits any page containing the injected content, thereby compromising the integrity of affected websites.
Affected Version(s)
Carousel, Recent Post Slider and Banner Slider * <= 2.0