CVE-2024-1712 Carousel Slider < 2.2.7 - Editor+ Stored XSS
High-privilege users can inject malicious scripts via unsanitized settings in the Carousel Slider plugin, affecting multisite environments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-1712?
CVE-2024-1712 is a medium-severity cross-site scripting vulnerability in Unknown Carousel Slider, published on 15 Apr 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Carousel Slider WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Weakness: CWE-79
Which versions are affected by CVE-2024-1712?
It affects 1 product.
Products include Majeedraza Carousel Slider.
How do I fix CVE-2024-1712?
No fix has been published for CVE-2024-1712 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-1712 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-1712 exists.
Other vulnerabilities in Unknown Carousel Slider
- CVE-2024-4372 Carousel Slider < 2.2.11 - Editor+ Stored XSS
- CVE-2023-41848 WordPress Carousel Slider plugin <= 2.2.2 - Broken Access Control vulnerability
- CVE-2024-6850 Carousel Slider < 2.2.14 - Editor+ Stored XSS
- CVE-2024-3703 Carousel Slider < 2.2.10 - Editor+ Stored XSS
- CVE-2024-45269 Cross-site request forgery in Carousel Slider
Sources
Also known as GHSA-wq89-j555-p43g.