Wp Skitter Slideshow Vulnerabilities

The Skitter Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pa...

CVSS:

4.4

Affected:

up to 2.5.2

Fix:

No patched version reported

Disclosed:

Mar 11, 2025

CVE-2025-28906 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thiago S.F. Skitter Slideshow allows Stored XSS. This issue affects Skitter Slideshow: from n/a through 2.5.2.

Affected:

up to 2.5.2

Fix:

No patched version reported

Disclosed:

Mar 11, 2025

CVE-2025-28906 on NVD →

[en] The Skitter Slideshow plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.2 via the /image.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query...

Affected:

up to 2.5.2

Fix:

No patched version reported

Disclosed:

Aug 17, 2024

CVE-2022-1751 on NVD →

The Skitter Slideshow plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.2 via the /image.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and...

CVSS:

7.2

Affected:

up to 2.5.2

Fix:

No patched version reported

Disclosed:

Jun 7, 2022

CVE-2022-1751 on NVD →