Slider Wd Vulnerabilities

The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.62. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a fo...

CVSS:

4.3

Affected:

up to 1.2.62

Fix:

No patched version reported

Disclosed:

Aug 18, 2026

CVE-2026-66635 on NVD →

[en] The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected:

up to 1.2.62

Fixed in:

1.2.62

Disclosed:

Mar 25, 2025

CVE-2024-10565 on NVD →

[en] The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected:

up to 1.2.62

Fixed in:

1.2.62

Disclosed:

Mar 25, 2025

CVE-2024-10566 on NVD →

The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget settings in all versions up to, and including, 1.2.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permis...

CVSS:

4.4

Affected:

up to 1.2.61

Fixed in:

1.2.62

Disclosed:

Mar 3, 2025

CVE-2024-10565 on NVD →

The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permiss...

CVSS:

4.4

Affected:

up to 1.2.61

Fixed in:

1.2.62

Disclosed:

Mar 3, 2025

CVE-2024-10566 on NVD →

[en] The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected:

up to 1.2.59

Fixed in:

1.2.59

Disclosed:

Sep 30, 2024

CVE-2024-8283 on NVD →

The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.58 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permiss...

CVSS:

4.4

Affected:

up to 1.2.58

Fixed in:

1.2.59

Disclosed:

Sep 9, 2024

CVE-2024-8283 on NVD →

[en] The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.2.57 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it p...

Affected:

up to 1.2.58

Fixed in:

1.2.58

Disclosed:

Aug 8, 2024

CVE-2024-7150 on NVD →

The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.2.57 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVSS:

8.8

Affected:

up to 1.2.57

Fixed in:

1.2.58

Disclosed:

Aug 7, 2024

CVE-2024-7150 on NVD →

[en] The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users such as editors and above to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Affected:

up to 1.2.57

Fixed in:

1.2.57

Disclosed:

Jul 31, 2024

CVE-2024-6408 on NVD →

[en] The Slider by 10Web WordPress plugin before 1.2.56 does not sanitise and escape some of its Slide options, which could allow authenticated users with access to the Sliders (by default Administrator, however this can be changed via the Slider by 10Web WordPress plugin before 1.2.56's options) and the ability to a...

Affected:

up to 1.2.56

Fixed in:

1.2.56

Disclosed:

Jul 11, 2024

CVE-2024-6026 on NVD →

The Slider by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via slider settings in all versions up to, and including, 1.2.56 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitr...

CVSS:

4.4

Affected:

up to 1.2.56

Fixed in:

1.2.57

Disclosed:

Jul 10, 2024

CVE-2024-6408 on NVD →

The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.55 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbit...

CVSS:

5.5

Affected:

up to 1.2.55

Fixed in:

1.2.56

Disclosed:

Jun 20, 2024

CVE-2024-6026 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Slider by 10Web allows Reflected XSS.This issue affects Slider by 10Web: from n/a through 1.2.54.

Affected:

up to 1.2.55

Fixed in:

1.2.55

Disclosed:

Apr 18, 2024

CVE-2024-32578 on NVD →

The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.2.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that e...

CVSS:

6.1

Affected:

up to 1.2.54

Fixed in:

1.2.55

Disclosed:

Apr 16, 2024

CVE-2024-32578 on NVD →

[en] The Sliderby10Web WordPress plugin before 1.2.53 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected:

up to 1.2.53

Fixed in:

1.2.53

Disclosed:

Dec 26, 2022

CVE-2022-4197 on NVD →

The Sliderby10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via slider row links in versions up to, and including, 1.2.52 due to insufficient input sanitization and output escaping. This makes it possible for administrator-level attackers to inject arbitrary web scripts in pages that will execut...

CVSS:

5.5

Affected:

up to 1.2.52

Fixed in:

1.2.53

Disclosed:

Nov 30, 2022

CVE-2022-4197 on NVD →

[en] The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Affected:

up to 1.2.52

Fixed in:

1.2.52

Disclosed:

May 23, 2022

CVE-2022-1320 on NVD →

The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVSS:

5.5

Affected:

up to 1.2.51

Fixed in:

1.2.52

Disclosed:

Apr 26, 2022

CVE-2022-1320 on NVD →

[en] The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plugin were vulnerable, allowing a high privileged user (Admin), or medium one such as Contributor+ (if "Role Options" is turn on for other users) to perform a SQL Injection attac...

Affected:

up to 1.2.36

Fixed in:

1.2.36

Disclosed:

Mar 18, 2021

CVE-2021-24132 on NVD →

The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plugin were vulnerable, allowing a high privileged user (Admin), or medium one such as Contributor+ (if "Role Options" is turn on for other users) to perform a SQL Injection attacks.

CVSS:

8.8

Affected:

up to 1.2.35

Fixed in:

1.2.36

Disclosed:

Sep 29, 2020

CVE-2021-24132 on NVD →

Multiple Authenticated SQL Injection (SQLi) vulnerabilities found by Nguyen Anh Tien in WordPress Slider by 10Web plugin (versions <= 1.2.35).

Affected:

up to 1.2.36

Fixed in:

1.2.36

Disclosed:

Sep 29, 2020

Update the WordPress Slider by 10Web plugin to the latest available version (at least 1.2.53). zhangyunpei discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Slider by 10Web Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and oth...

Affected:

up to 1.2.53

Fixed in:

1.2.53