Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: quantumcloud Component: Slider Hero Clear all filters
TI-2021-03281 CVE-2021-4424 · GHSA-6vc4-vj2v-qvwx

Slider Hero <= 8.2.0 - Cross-Site Request Forgery Bypass

Priority LOW 20

The Slider Hero plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.2.0.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00393 Published 2023-07-12 No fix listed CWE-352
TI-2022-02836 CVE-2022-3074 · GHSA-4wvm-h8w2-gjm9

Slider Hero < 8.4.4 - Admin+ Stored Cross-Site Scripting

Priority MEDIUM 55

The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00604 Published 2022-09-26 Fixed in 8.4.4 CWE-79
TI-2021-06793 CVE-2021-24506 · GHSA-5h5h-7rmg-7673

Slider Hero < 8.2.7 - Contributor+ SQL Injection

Priority MEDIUM 41

The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users wi…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01362 Published 2021-08-23 Fixed in 8.2.7 CWE-89