CVE-2024-2949: Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp_wp_carousel_shortcode'
The Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the carousel widget in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2949?
CVE-2024-2949 has a medium severity rating due to the potential for Stored Cross-Site Scripting exploits.
How do I fix CVE-2024-2949?
To resolve CVE-2024-2949, update the WP Carousel plugin to version 2.6.4 or later.
What versions are affected by CVE-2024-2949?
CVE-2024-2949 affects all versions of the WP Carousel plugin up to and including 2.6.3.
What is Stored Cross-Site Scripting in relation to CVE-2024-2949?
Stored Cross-Site Scripting in CVE-2024-2949 allows attackers to inject malicious scripts into the carousel widget, impacting users who view the content.
Who should be concerned about CVE-2024-2949?
Website administrators using the WP Carousel plugin below version 2.6.4 should be actively concerned about CVE-2024-2949.