PT-2024-37329 · 10Web · Sliderby10Web Wordpress Plugin

Dmitry Ignatyev · Published 2024-07-11 · Updated 2024-07-12 · CVE-2024-6026

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: The Slider by 10Web WordPress plugin version 1.2.55 and earlier

Description: The issue concerns the Slider by 10Web WordPress plugin, which does not properly sanitise and escape some of its Slide options. This could allow authenticated users with access to the Sliders, by default Administrators, and the ability to add images, to perform Stored Cross-Site Scripting attacks.

Recommendations: For versions prior to 1.2.56, update to version 1.2.56 or later to resolve the issue. As a temporary workaround, consider restricting access to the Sliders and limiting the ability to add images to trusted users only, until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-6026

Affected Products

Sliderby10Web Wordpress Plugin

References · 8

• 🔥 https://wpscan.com/vulnerability/01609d84-e9eb-46a9-b2cc-fe7e0c982984 · Exploit
• https://osv.dev/vulnerability/CVE-2024-6026 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6026 · Security Note
• https://t.me/cvenotify/86071 · Telegram Post
• https://twitter.com/CVEnew/status/1811322652336009350 · Twitter Post
• https://t.me/cvenotify/85779 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1811352887638843634 · Twitter Post
• https://t.me/cvedetector/635 · Telegram Post