PT-2021-15915 · WordPress · Smart Slider 3

Blackangel + 1 · Published 2021-06-14 · Updated 2021-06-22 · CVE-2021-24382

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Smart Slider 3 versions prior to 3.5.0.9

Description The issue is related to a Stored Cross-Site Scripting problem. It occurs because the Project Name is not properly sanitized before being outputted back on the page. By default, only administrator users have access to the affected functionality, which limits the potential for exploitation. However, if WordPress administrators allow users with lesser privileges to access the plugin's functionality, it could lead to privilege escalation.

Recommendations For versions prior to 3.5.0.9, update to version 3.5.0.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to only administrator users to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24382

Affected Products

Smart Slider 3

References · 6

• 🔥 https://wpscan.com/vulnerability/7b32a282-e51f-4ee5-b59f-5ba10e62a54d · Exploit
• https://osv.dev/vulnerability/CVE-2021-24382 · Vendor Advisory
• https://smartslider.helpscoutdocs.com/article/1746-changelog · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24382 · Security Note
• https://t.me/cvenotify/16248 · Telegram Post
• https://t.me/cvenotify/16689 · Telegram Post