Smart Slider 3 < 3.5.0.9 - Authenticated Stored Cross-Site Scripting (XSS)
Priority LOW 26CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed.
Why it matters now
EPSS 0.00676 52nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Smart Slider 3 (Nextend): 3.5.0.9
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextendweb | Smart Slider 3 | 3.5.0.9 to before 3.5.0.9 | 3.5.0.9 | Patch available | CNA |
| nextendweb | Smart Slider 3 | 3.5.0.9 to before 3.5.0.9 | 3.5.0.9 | Patch available | CNA |
- Smart Slider 3 Vendornextendweb Affected 3.5.0.9 to before 3.5.0.9 Fixed in 3.5.0.9 Patch available CNA
- Smart Slider 3 Vendornextendweb Affected 3.5.0.9 to before 3.5.0.9 Fixed in 3.5.0.9 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextendweb:smart_slider:*:*:*:*:free:wordpress:*:* | 3.0 to before 3.5.0.9 | Vulnerable | nextendweb |
| cpe:2.3:a:nextendweb:smart_slider:*:*:*:*:pro:wordpress:*:* | 3.0 to before 3.5.0.9 | Vulnerable | nextendweb |
- cpe:2.3:a:nextendweb:smart_slider:*:*:*:*:free:wordpress:*:* Versions 3.0 to before 3.5.0.9 Vulnerable ·nextendweb
- cpe:2.3:a:nextendweb:smart_slider:*:*:*:*:pro:wordpress:*:* Versions 3.0 to before 3.5.0.9 Vulnerable ·nextendweb
Remediation
- Fix · CNA Smart Slider 3 (Nextend) Fixed in 3.5.0.9
- Fix · CNA Smart Slider 3 (Nextend) Fixed in 3.5.0.9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24382
- 2026-10-03 Alias added: GHSA-phjq-x57m-mw68
References
Sources
- CVE-2021-24382 · CVE Program
- CVE-2021-24382 · NVD
- FIRST EPSS
- GHSA-phjq-x57m-mw68 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences