Vulnerabilities

TI-2024-04258 CVE-2024-4575 · GHSA-g6hx-qvw2-39jx

LayerSlider 7.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ls_search_form Shortcode

LOW 28

The LayerSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ls_search_form shortcode in version 7.11.0 due to insufficient input sanitization and output escaping on user supplied at…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00274 Published 2024-05-23 No fix listed

TI-2024-02687 CVE-2024-2879 · GHSA-53x2-fcg3-m32m

SQL injection in LayerSlider

HIGH 67

The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient prep…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.18402 Published 2024-04-03 No fix listed CWE-89

TI-2023-25896 CVE-2023-47786 · GHSA-64ph-p28q-q2mh

WordPress LayerSlider Plugin <= 7.7.9 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LayerSlider plugin <= 7.7.9 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00368 Published 2023-11-22 No fix listed CWE-79

TI-2023-25895 CVE-2023-47785 · GHSA-62p7-q59j-46ph

WordPress LayerSlider Plugin <= 7.7.9 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in LayerSlider plugin <= 7.7.9 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00254 Published 2023-11-22 No fix listed CWE-352

TI-2022-01042 CVE-2022-1153 · GHSA-fq4m-w42p-h4c2

LayerSlider < 7.1.2 - Admin+ Stored Cross-Site Scripting