Meteor Slides Vulnerabilities

[en] The Meteor Slides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slide_url_value' parameter in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above...

Affected:

up to 1.5.7

Fix:

No patched version reported

Disclosed:

Jan 7, 2025

CVE-2024-12073 on NVD →

The Meteor Slides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slide_url_value' parameter in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

CVSS:

6.4

Affected:

up to 1.5.7

Fix:

No patched version reported

Disclosed:

Jan 6, 2025

CVE-2024-12073 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Leuze Meteor Slides allows Stored XSS.This issue affects Meteor Slides: from n/a through 1.5.7.

Affected:

up to 1.5.7

Fix:

No patched version reported

Disclosed:

Dec 2, 2024

CVE-2024-52493 on NVD →

The Meteor Slides plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages...

CVSS:

4.4

Affected:

up to 1.5.7

Fix:

No patched version reported

Disclosed:

Nov 20, 2024

CVE-2024-52493 on NVD →

[en] The Meteor Slides WordPress plugin before 1.5.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as ad...

Affected:

up to 1.5.7

Fixed in:

1.5.7

Disclosed:

Jan 16, 2023

CVE-2022-4486 on NVD →

The Meteor Slides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode in versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web...

CVSS:

6.4

Affected:

up to 1.5.6

Fixed in:

1.5.7

Disclosed:

Dec 21, 2022

CVE-2022-4486 on NVD →