Slick Engagement Vulnerabilities

The Slickstream: Engagement and Conversions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted the...

CVSS:

4.3

Affected:

up to 2.0.3

Fixed in:

3.0.0

Disclosed:

Jun 27, 2025

CVE-2025-53273 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Slickstream Slickstream allows Cross Site Request Forgery. This issue affects Slickstream: from n/a through 2.0.3.

Affected:

up to 2.0.3

Fix:

No patched version reported

Disclosed:

Jun 27, 2025

CVE-2025-53273 on NVD →

[en] The Slickstream: Engagement and Conversions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slick-grid shortcode in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenti...

Affected:

up to 2.0.0

Fixed in:

2.0.0

Disclosed:

Nov 12, 2024

CVE-2024-10179 on NVD →

The Slickstream: Engagement and Conversions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slick-grid shortcode in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVSS:

6.4

Affected:

up to 1.4.4

Fixed in:

2.0.0

Disclosed:

Nov 11, 2024

CVE-2024-10179 on NVD →