Stored Cross-Site Scripting in Master Slider Plugin for WordPress

CVE-2024-11731

What is CVE-2024-11731?

The Master Slider – Responsive Touch Slider plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping on user-provided attributes in the ms_slider shortcode. This vulnerability allows authenticated users with contributor-level access or higher to inject malicious scripts into pages. These scripts will execute whenever a user visits an affected page, potentially compromising user data and leading to unauthorized actions on behalf of legitimate users.

References