SQL Injection Vulnerability in Hero Slider by WordPress
CVE-2024-13809

6.5MEDIUM

Key Information:

Vendor
Heroplugins
Status
Hero Slider - WordPress Slider Plugin
Vendor
CVE Published:
5 March 2025

Summary

The Hero Slider plugin for WordPress is subject to SQL Injection vulnerabilities, impacting all versions up to and including 1.3.5. Due to inadequate escaping of user-supplied data and insufficient preparation of SQL queries, authenticated attackers with Subscriber-level access or higher can inject additional SQL queries into existing ones. This may allow them to extract sensitive information from the database, posing a significant risk to users and their data integrity.

Affected Version(s)

Hero Slider - WordPress Slider Plugin * <= 1.3.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://codecanyon.net/item/hero-slider-wordpress-slider-...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucio Sá
.