Cross-Site Request Forgery in WordPress Video Carousel Slider Plugin

CVE-2023-5945

Summary

The Video Carousel Slider with Lightbox plugin for WordPress is susceptible to a Cross-Site Request Forgery flaw in version 1.0. This vulnerability stems from inadequate nonce validation within the responsive_video_gallery_with_lightbox_video_management_func() function. As a result, unauthenticated attackers may exploit this weakness to delete videos from the slider by tricking an administrator into executing a malicious action, such as clicking a crafted link. This poses a significant risk to the integrity of media content managed through the plugin.

References