plugin
6 known security issues reported for the Slider Factory WordPress plugin. Most recent disclosed Oct 20, 2021.
Running Slider Factory on your site? Check whether your installed version is affected.
Scan your site freeThe Responsive Image Slider, Photo Gallery And Carousel plugin for WordPress is vulnerable to arbitrary post access due to a missing capability check on the sf_image_id function in versions before 1.3.6. This makes it possible for authenticated attackers with subscriber-level privileges or above to arbitrarily access p...
The Responsive Image Slider, Photo Gallery And Carousel plugin for WordPress is vulnerable to arbitrary post access due to a missing capability check on the sf_image_id function in versions before 1.3.6. This makes it possible for authenticated attackers with subscriber-level privileges or above to arbitrarily access p...
The Responsive Image Slider, Photo Gallery And Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions before 1.3.2. This is due to missing or incorrect nonce validation on the sf_clone_slider, sf_save_slider, and sf_remove_slider functions. This makes it possible for unauthenticated attac...
The Responsive Image Slider, Photo Gallery And Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions before 1.3.2. This is due to missing or incorrect nonce validation on the sf_clone_slider, sf_save_slider, and sf_remove_slider functions. This makes it possible for unauthenticated attac...
The plugin does not have proper authorisation check in the sf_image_id AJAX action, which could allow any authenticated, such as subscriber, to view the content and title of arbitrary posts, for example private, draft and password protected ones.
The plugin has a logic flaw in its CSRF checks in the sf_clone_slider, sf_save_slider and sf_remove_slider AJAX actions, which could allow an attacker to make a logged in user call them via a CSRF attack.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free