Vulnerability record/PUBLISHED/Published Jul 31, 2024 06:00:03 UTC
CVE-2024-6408
The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users such as editors and above to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Base score5.4/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredLowPR
User interactionRequiredUI
ScopeChangedS
Confidentiality impactLowC
Integrity impactLowI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedJul 31, 2024 13:30:13 UTC
PublishedJul 31, 2024 06:00:03 UTC
ReservedJun 28, 2024 17:02:59 UTC
Credits
- Dmitrii Ignatyev
- WPScan