Stored Cross-Site Scripting Vulnerability in Slider Revolution Plugin by WordPress
CVE-2024-4092

6.4MEDIUM

Key Information:

Vendor
Wordpress
Vendor
CVE Published:
2 May 2024

Summary

The Slider Revolution plugin for WordPress is impacted by a Stored Cross-Site Scripting vulnerability through the ‘htmltag’ parameter across all versions up to 6.7.7. This flaw arises from inadequate input sanitization and output escaping, allowing authenticated attackers, primarily administrators but potentially extending to authors, to inject malicious scripts into web pages. These scripts execute whenever a user accesses the compromised page, threatening the site's integrity and user security.

Affected Version(s)

Slider Revolution * <= 6.7.7

References

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

wesley
.