CVE-2024-1449
CVSS 3.1 Score 5.4 of 10 (medium)
Details
Published Mar 2, 2024
Updated: Jan 7, 2025
CWE ID 79
Summary
CVE-2024-1449: The Master Slider plugin for WordPress, versions up to 3.9.5, is found to have a Stored Cross-Site Scripting (XSS) vulnerability. This issue arises due to inadequate sanitization and output escaping of user-supplied attributes in the ms_slide shortcode. Consequently, authenticated attackers with contributor-level access and above can inject malicious scripts into pages. These scripts will be executed whenever an affected user opens an injected page.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Averta Master Slider