Serious Slider <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute
medium
The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inj...
- CVSS:
- 6.4
- Affected:
- up to 1.4.0
- Fixed in:
- 1.4.1
- Disclosed:
- Aug 15, 2026
CVE-2026-15726 on NVD →
Serious Slider <= 1.2.7 - Missing Authorization
medium
The Serious Slider plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
- CVSS:
- 4.3
- Affected:
- up to 1.2.7
- Fixed in:
- 1.3.0
- Disclosed:
- Jan 30, 2026
CVE-2026-25399 on NVD →
Serious Slider <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
medium
The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'serious-slider' shortcode in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with co...
- CVSS:
- 6.4
- Affected:
- up to 1.2.6
- Fixed in:
- 1.2.7
- Disclosed:
- Nov 29, 2024
CVE-2024-11108 on NVD →
Serious Slider <= 1.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting
medium
The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pag...
- CVSS:
- 4.4
- Affected:
- up to 1.2.4
- Fixed in:
- 1.2.5
- Disclosed:
- Jun 17, 2024
CVE-2024-35762 on NVD →
Serious Slider <= 1.2.4 - Cross-Site Request Forgery
medium
The Serious Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site admini...
- CVSS:
- 4.3
- Affected:
- up to 1.2.4
- Fixed in:
- 1.2.5
- Disclosed:
- Apr 25, 2024
CVE-2024-33650 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database