Magic Carousel Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Magic Responsive Slider and Carousel WordPress magic_carousel allows Reflected XSS.This issue affects Magic Responsive Slider and Carousel WordPress: from n/a through <= 1.6.

Affected:

up to 1.6

Fix:

No patched version reported

Disclosed:

Jan 22, 2026

CVE-2025-49043 on NVD →

The Magic Responsive Slider and Carousel WordPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with...

CVSS:

6.5

Affected:

up to 1.6

Fixed in:

1.6

Disclosed:

May 16, 2025

CVE-2025-31640 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Magic Responsive Slider and Carousel WordPress allows SQL Injection. This issue affects Magic Responsive Slider and Carousel WordPress: from n/a through 1.4.

Affected:

up to 1.4

Fix:

No patched version reported

Disclosed:

May 16, 2025

CVE-2025-31640 on NVD →