CVE-2022-2823: Slider, Gallery, and Carousel by MetaSlider < 3.27.9 - Admin+ Stored Cross Site Scripting
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.27.9 does not sanitise and escape some of its Gallery Image parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2823?
CVE-2022-2823 has been categorized as a high severity vulnerability due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2022-2823?
To fix CVE-2022-2823, update the MetaSlider plugin to version 3.27.9 or later.
Who is affected by CVE-2022-2823?
CVE-2022-2823 affects users of the MetaSlider, Gallery, and Carousel WordPress plugin prior to version 3.27.9.
What type of attack can be executed through CVE-2022-2823?
CVE-2022-2823 allows high privilege users to perform stored cross-site scripting (XSS) attacks.
What components of the MetaSlider plugin are vulnerable in CVE-2022-2823?
CVE-2022-2823 specifically affects the gallery image parameters in the Slider, Gallery, and Carousel components of the MetaSlider plugin.