CVE-2023-2120: XSS
First published: Tue Apr 18 2023(Updated: )
The Thumbnail carousel slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| I13websolution Thumbnail Carousel Slider | <=1.1.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/browser/wp-responsive-thumbnail-slider/trunk/wp-responsive-images-thumbnail-slider.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2813150%40wp-responsive-thumbnail-slider%2Ftags%2F1.1.9&new=2899786%40wp-responsive-thumbnail-slider%2Ftags%2F1.1.10
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f4bf4e12-5cbb-45bc-938e-62163baaa15d?source=cve
Frequently Asked Questions
What is CVE-2023-2120?
CVE-2023-2120 is a vulnerability in the Thumbnail carousel slider plugin for WordPress that allows for Reflected Cross-Site Scripting.
What is the severity of CVE-2023-2120?
The severity of CVE-2023-2120 is medium with a CVSS score of 6.1.
How does CVE-2023-2120 affect the Thumbnail carousel slider plugin for WordPress?
CVE-2023-2120 affects versions up to, and including, 1.1.9 of the Thumbnail carousel slider plugin for WordPress.
How can unauthenticated attackers exploit CVE-2023-2120?
Unauthenticated attackers can exploit CVE-2023-2120 by injecting arbitrary code through the search_term parameter.
Are there any fixes available for CVE-2023-2120?
Yes, fixes for CVE-2023-2120 are available in versions 1.1.10 and above of the Thumbnail carousel slider plugin for WordPress.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/tags
- agent/event
- agent/description
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/i13websolution
- canonical/i13websolution thumbnail carousel slider
- version/i13websolution thumbnail carousel slider/1.1.9