Carousel Slider Vulnerabilities

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-l...

CVSS:

6.4

Affected:

up to 2.2.14

Fixed in:

2.2.15

Disclosed:

Jul 2, 2025

CVE-2024-5647 on NVD →

[en] Missing Authorization vulnerability in Majeed Raza Carousel Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Carousel Slider: from n/a through 2.2.2.

Affected:

up to 2.2.3

Fixed in:

2.2.3

Disclosed:

Dec 13, 2024

CVE-2023-41848 on NVD →

[en] The Carousel Slider WordPress plugin before 2.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Affected:

up to 2.2.14

Fixed in:

2.2.14

Disclosed:

Sep 13, 2024

CVE-2024-6850 on NVD →

[en] WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection feature. While logged in to the WordPress site with Carousel Slider plugin enabled, accessing a crafted page may cause a user to alter the contents of the WordPress site.

Affected:

up to 2.0.0

Fixed in:

2.0.0

Disclosed:

Sep 1, 2024

CVE-2024-45269 on NVD →

[en] WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feature. While logged in to the WordPress site with Carousel Slider plugin enabled, accessing a crafted page may cause a user to alter the contents of the WordPress site.

Affected:

up to 2.2.4

Fixed in:

2.2.4

Disclosed:

Sep 1, 2024

CVE-2024-45270 on NVD →

The Carousel Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.10.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to manipulate data from the image selection feature via a forged req...

CVSS:

4.3

Affected:

up to 1.10.2

Fixed in:

2.0.0

Disclosed:

Aug 30, 2024

CVE-2024-45269 on NVD →

The Carousel Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.3. This is due to missing or incorrect nonce validation on the add_slide_template() function. This makes it possible for unauthenticated attackers to add slides via a forged request granted the...

CVSS:

4.3

Affected:

up to 2.2.3

Fixed in:

2.2.4

Disclosed:

Aug 30, 2024

CVE-2024-45270 on NVD →

The Carousel Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web...

CVSS:

4.4

Affected:

up to 2.2.13

Fixed in:

2.2.14

Disclosed:

Aug 23, 2024

CVE-2024-6850 on NVD →

[en] The Carousel Slider WordPress plugin before 2.2.11 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks

Affected:

up to 2.2.11

Fixed in:

2.2.11

Disclosed:

May 21, 2024

CVE-2024-4372 on NVD →

[en] The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embed, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks

Affected:

up to 2.2.10

Fixed in:

2.2.10

Disclosed:

May 3, 2024

CVE-2024-3703 on NVD →

The Carousel Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url view parameter in all versions up to, and including, 2.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that wil...

CVSS:

5.5

Affected:

up to 2.2.10

Fixed in:

2.2.11

Disclosed:

Apr 30, 2024

CVE-2024-4372 on NVD →

[en] The Carousel Slider WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected:

up to 2.2.7

Fixed in:

2.2.7

Disclosed:

Apr 15, 2024

CVE-2024-1712 on NVD →

The Carousel Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via slide options settings in all versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject...

CVSS:

4.4

Affected:

up to 2.2.9

Fixed in:

2.2.10

Disclosed:

Apr 12, 2024

CVE-2024-3703 on NVD →

The Carousel Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_optin_optout() function hooked via 'admin_init' in versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to opt in and opt out of tracking for...

CVSS:

4.3

Affected:

up to 2.2.2

Fixed in:

2.2.3

Disclosed:

Sep 5, 2023

CVE-2023-41848 on NVD →

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribu...

Affected:

up to 2.2.15

Fixed in:

2.2.15