WP Contact Slider – Slide Out Contact Form for WordPress to display Contact Form 7, Gravity Forms, WP Forms, Ninja Forms, plain text/HTML & other shortcodes [wp-contact-slider] < 2.4.5
unknown
[en] The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4....
- Affected:
- up to 2.4.5
- Fixed in:
- 2.4.5
- Disclosed:
- Oct 16, 2024
CVE-2022-4974 on NVD →
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
medium
The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...
- CVSS:
- 6.1
- Affected:
- up to 2.4.8
- Fixed in:
- 2.4.9
- Disclosed:
- Jul 18, 2023
CVE-2023-33999 on NVD →
WP Contact Slider – Slide Out Contact Form for WordPress to display Contact Form 7, Gravity Forms, WP Forms, Ninja Forms, plain text/HTML & other shortcodes [wp-contact-slider] < 2.4.8
unknown
[en] The WP Contact Slider WordPress plugin before 2.4.8 does not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Affected:
- up to 2.4.8
- Fixed in:
- 2.4.8
- Disclosed:
- Oct 31, 2022
CVE-2022-3237 on NVD →
WP Contact Slider <= 2.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
medium
The WP Contact Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Text to display’ parameter in versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and abo...
- CVSS:
- 5.5
- Affected:
- up to 2.4.7
- Fixed in:
- 2.4.8
- Disclosed:
- Oct 10, 2022
CVE-2022-3237 on NVD →
WP Contact Slider – Slide Out Contact Form for WordPress to display Contact Form 7, Gravity Forms, WP Forms, Ninja Forms, plain text/HTML & other shortcodes [wp-contact-slider] < 2.4.7
unknown
[en] The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow high privileged users such as editor and above to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Affected:
- up to 2.4.7
- Fixed in:
- 2.4.7
- Disclosed:
- Jul 4, 2022
CVE-2022-1301 on NVD →
WP Contact Slider <= 2.4.6 - Stored Cross-Site Scripting
medium
The WP Contact Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the settings of sliders in versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with editor level permissions and above to inject arb...
- CVSS:
- 4.8
- Affected:
- up to 2.4.6
- Fixed in:
- 2.4.7
- Disclosed:
- Jun 13, 2022
CVE-2022-1301 on NVD →
Freemius SDK <= 2.4.2 - Missing Authorization Checks
medium
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...
- CVSS:
- 6.3
- Affected:
- up to 2.4.5
- Fixed in:
- 2.4.5
- Disclosed:
- Mar 4, 2022
CVE-2022-4974 on NVD →
WP Contact Slider – Slide Out Contact Form for WordPress to display Contact Form 7, Gravity Forms, WP Forms, Ninja Forms, plain text/HTML & other shortcodes [wp-contact-slider] < 2.4.5
unknown
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...
- Affected:
- up to 2.4.5
- Fixed in:
- 2.4.5
- Disclosed:
- Mar 4, 2022
WP Contact Slider – Slide Out Contact Form for WordPress to display Contact Form 7, Gravity Forms, WP Forms, Ninja Forms, plain text/HTML & other shortcodes [wp-contact-slider] < 2.4.5
unknown
Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress WP Contact Slider plugin (versions <= 2.4.4).
- Affected:
- up to 2.4.5
- Fixed in:
- 2.4.5
- Disclosed:
- Feb 28, 2022
WP Contact Slider – Slide Out Contact Form for WordPress to display Contact Form 7, Gravity Forms, WP Forms, Ninja Forms, plain text/HTML & other shortcodes [wp-contact-slider] < 2.4.5
unknown
Sensitive Information Disclosure vulnerability discovered in WordPress WP Contact Slider plugin (versions <= 2.4.4).
- Affected:
- up to 2.4.5
- Fixed in:
- 2.4.5
- Disclosed:
- Feb 28, 2022
WP Contact Slider – Slide Out Contact Form for WordPress to display Contact Form 7, Gravity Forms, WP Forms, Ninja Forms, plain text/HTML & other shortcodes [wp-contact-slider] < 2.4.9
unknown
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
- Affected:
- up to 2.4.9
- Fixed in:
- 2.4.9
CVE-2023-33999 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database