CVE-2023-6382: Master Slider - Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'msslide' shortcode in all versions up to, and including, 3.9.9 due to insufficient input sanitization and output escaping on user supplied 'cssclass' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6382?
CVE-2023-6382 has a high-severity vulnerability rating due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2023-6382?
To fix CVE-2023-6382, update the Master Slider plugin to version 3.9.10 or later.
What impact does CVE-2023-6382 have on my WordPress site?
CVE-2023-6382 allows attackers to inject malicious scripts into your website, compromising user data and site integrity.
Who is affected by CVE-2023-6382?
Any WordPress site using the Master Slider plugin version 3.9.9 or earlier is susceptible to CVE-2023-6382.
Is there a workaround for CVE-2023-6382 if I cannot update immediately?
As a temporary workaround for CVE-2023-6382, avoid using the 'ms_slide' shortcode until the plugin is updated.