IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
6.1Orta

CVE-2024-10565Slider by 10Web < 1.2.62 - Admin+ Stored XSS via Widget

Slider by 10Web Yayım: (1 yıl önce)

Açıklama

The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Zayıflık türü (CWE): CWE-79

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
10web slider < 1.2.62
— Slider by 10Web < 1.2.62

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (1)
  • cpe:2.3:a:10web:slider:*:*:*:*:*:wordpress:*:* < 1.2.62

Aynı üründe son açıklar — WordPress plugins & themes

Puansız
CVE-2026-127048

Lazy Blocks < 3.0.0 - Unauthenticated RCE

Custom Block Builder

The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary…