CVE-2024-4581: Slider Revolution <= 6.7.11 - Authenticated (Author+) Stored Cross-Site Scripting via Add Layer class, id, and title Attributes
First published: Tue Jun 04 2024(Updated: )
The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Add Layer widget in all versions up to, and including, 6.7.11 due to insufficient input sanitization and output escaping on the user supplied 'class', 'id', and 'title' attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Successful exploitation of this vulnerability requires an Administrator to give Slider Creation privileges to Author-level users.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Slider Revolution | <=6.7.11 | |
| Slider Revolution | <6.7.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-4581?
CVE-2024-4581 is classified as a high severity vulnerability due to its exploitation potential for Stored Cross-Site Scripting.
How do I fix CVE-2024-4581?
To fix CVE-2024-4581, update the Slider Revolution plugin to version 6.7.12 or later.
Which versions are affected by CVE-2024-4581?
CVE-2024-4581 affects all Slider Revolution plugin versions up to and including 6.7.11.
What kind of vulnerability is CVE-2024-4581?
CVE-2024-4581 is a Stored Cross-Site Scripting vulnerability affecting the Add Layer widget of the Slider Revolution plugin.
What impact does CVE-2024-4581 have on my WordPress site?
If exploited, CVE-2024-4581 could allow an attacker to inject malicious scripts, leading to unauthorized actions on behalf of users.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- vendor/slider revolution
- canonical/slider revolution
- vendor/themepunch