CVE-2022-4482medium

CVE-2022-4482: medium-severity vulnerability in Carousel, Slider, Gallery by WP Carousel

Carousel, Slider, Gallery by WP Carousel < 2.5.3 - Contributor+ Stored XSS

Published · Updated

Follow this CVE+ Monitor Carousel, Slider, Gallery by WP Carousel

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.5%
The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Unknown · Carousel, Slider, Gallery by WP Carousel
Related CVEs — Carousel, Slider, Gallery by WP Carousel

In the same product, most dangerous first.

CVE-2024-13314LOWCarousel, Slider, Gallery by WP Carousel < 2.7.4 - Admin+ Stored XSSEPSS 0.4%CVE-2024-4002LOWCarousel, Slider, Gallery by WP Carousel < 2.6.9 - Editor+ Stored XSSEPSS 0.4%