Stored Cross-Site Scripting Vulnerability in Slider Revolution Plugin by WordPress
CVE-2024-4092
6.4MEDIUM
Summary
The Slider Revolution plugin for WordPress is impacted by a Stored Cross-Site Scripting vulnerability through the ‘htmltag’ parameter across all versions up to 6.7.7. This flaw arises from inadequate input sanitization and output escaping, allowing authenticated attackers, primarily administrators but potentially extending to authors, to inject malicious scripts into web pages. These scripts execute whenever a user accesses the compromised page, threatening the site's integrity and user security.
Affected Version(s)
Slider Revolution * <= 6.7.7
References
CVSS V3.1
Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
wesley