PT-2024-10563 · WordPress · Team Circle Image Slider With Lightbox

Ala Arfaoui · Published 2024-03-13 · Updated 2025-03-21 · CVE-2015-10130

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Team Circle Image Slider With Lightbox plugin for WordPress version 1.0

Description The issue is due to missing or incorrect nonce validation on the circle thumbnail slider with lightbox image management func() function, making it possible for unauthenticated attackers to edit image data, which can be used to inject malicious JavaScript. Attackers can also delete images and upload malicious files via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

Recommendations For version 1.0, consider disabling the circle thumbnail slider with lightbox image management func() function until a patch is available to prevent exploitation. Restrict access to image management functionality to minimize the risk of unauthorized edits or uploads.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-10130

Affected Products

Team Circle Image Slider With Lightbox

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-10130 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1269993%40circle-image-slider-with-lightbox&new=1269993%40circle-image-slider-with-lightbox&sfp_email=&sfph_mail= · Patch
• https://t.me/cvenotify/73679 · Telegram Post
• https://t.me/cvenotify/115626 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b6a54470-fc66-43c5-a523-ddbefd47ee1f?source=cve · Note