CVE-2021-24196: Social Slider Widget < 1.8.5 - Authenticated Reflected Cross-Site Scripting (XSS)
The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘tokenerror’ parameter can be controlled by users and it is directly echoed without being sanitized
Other sources
The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘tokenerror’ parameter can be controlled by users and it is directly echoed without being sanitized
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24196?
CVE-2021-24196 is a vulnerability in the Social Slider Widget WordPress plugin that allows Authenticated Reflected XSS.
How does CVE-2021-24196 affect the plugin?
CVE-2021-24196 allows Authenticated Reflected XSS in the plugin settings page.
What is the severity of CVE-2021-24196?
The severity of CVE-2021-24196 is medium, with a CVSS score of 5.4.
How can CVE-2021-24196 be exploited?
CVE-2021-24196 can be exploited by controlling the 'token_error' parameter in the plugin settings page.
Is there a fix for CVE-2021-24196?
Yes, the fix for CVE-2021-24196 is to update the Social Slider Widget plugin to version 1.8.5 or above.