YSlider <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
mediumThe YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.1. This is due to missing nonce verification on the content configuration page and insufficient input sanitization and output escaping. This makes it possible for unauthent...
- CVSS:
- 6.1
- Affected:
- up to 1.1
- Fix:
- No patched version reported
- Disclosed:
- Nov 10, 2025