Extension WordPress
Vulnérabilités LayerSlider
Cette page rassemble les failles publiées pour LayerSlider, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de LayerSlider
9 fiches
LayerSlider 7.11.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ls_search_form Shortcode
The LayerSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ls_search_form shortcode in version 7.11.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,…
7.11.0
7.11.1
22/05/2024
LayerSlider 7.9.11 – 7.10.0 – Unauthenticated SQL Injection
The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.…
7.9.11-7.10.0
7.10.1
02/04/2024
LayerSlider <= 7.7.9 – Cross-Site Request Forgery
The LayerSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.7.9. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated…
*-7.7.9
7.7.10
14/11/2023
LayerSlider <= 7.7.9 – Authenticated (Contributor+) Stored Cross-Site Scripting
The LayerSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 7.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,…
*-7.7.9
7.7.10
14/11/2023
LayerSlider <= 7.1.1 – Admin+ Stored Cross-Site Scripting
The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html…
*-7.1.1
7.1.2
11/04/2022
LayerSlider <= 6.2.0 – Cross-Site Request Forgery
The LayerSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.2.0. This is due to missing or incorrect nonce validation on the ls_save_screen_options() function. This makes it possible for authenticated attackers…
*-6.2.0
6.2.1
28/03/2017
LayerSlider <= 6.2.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting
The LayerSlider plugin for WordPress is vulnerable to Cross-Site Request forgery in versions up to, and including 6.2.0, due missing nonce validation on an unspecified function that makes it possible for attackers to trick site administrators into performing…
[*, 6.2.1)
6.2.1
28/03/2017
LayerSlider <= 4.6.1 – Path Traversal
The LayerSlider plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 4.6.1 via the LayerSlider/editor.php skin parameter. This allows unauthenticated attackers to read the contents of arbitrary files on the server, which can…
*-4.6.1
5.2.0
01/08/2014
LayerSlider <= 4.6.1 – Cross-Site Request Forgery
The LayerSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.6.1. This is due to missing or incorrect nonce validation on the style editing functions in the settings page. This makes…
*-4.6.1
5.2.0
01/08/2014
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.