Woocommerce Products Slider Vulnerabilities

The Product Slider, Product Grid, Product Masonry plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.13.62 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to perfo...

CVSS:

4.3

Affected:

up to 1.13.62

Fixed in:

1.13.63

Disclosed:

Jul 22, 2026

CVE-2026-65456 on NVD →

The Product Slider, Product Grid, Product Masonry plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.13.61. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized ac...

CVSS:

4.3

Affected:

up to 1.13.61

Fixed in:

1.13.62

Disclosed:

Mar 17, 2026

CVE-2026-25455 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins Product Slider for WooCommerce allows Reflected XSS.This issue affects Product Slider for WooCommerce: from n/a through 1.13.50.

Affected:

up to 1.13.51

Fixed in:

1.13.51

Disclosed:

Sep 15, 2024

CVE-2024-45459 on NVD →

The Product Slider for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.13.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they...

CVSS:

6.1

Affected:

up to 1.13.50

Fixed in:

1.13.51

Disclosed:

Sep 12, 2024

CVE-2024-45459 on NVD →

[en] The Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

Affected:

up to 1.13.42

Fixed in:

1.13.42

Disclosed:

Feb 13, 2023

CVE-2023-0166 on NVD →

The PickPlugins Product Slider for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 1.13.41 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attack...

CVSS:

6.4

Affected:

up to 1.13.41

Fixed in:

1.13.42

Disclosed:

Jan 23, 2023

CVE-2023-0166 on NVD →

[en] The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue

Affected:

up to 1.13.22

Fixed in:

1.13.22

Disclosed:

May 24, 2021

CVE-2021-24300 on NVD →

The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue

CVSS:

6.1

Affected:

up to 1.13.21

Fixed in:

1.13.22

Disclosed:

May 6, 2021

CVE-2021-24300 on NVD →