Image Slider Widget
Monthly
Stored cross-site scripting in the GhozyLab Image Slider Widget WordPress plugin (versions through 1.1.130) lets an authenticated low-privilege user - a contributor or author able to submit content - inject script into slider fields that executes in the browser of any administrator or editor who later views the rendered slider. CVSS 3.1 rates this 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting mandatory authentication (PR:L), required victim interaction (UI:R), and scope change because the payload escapes the plugin's context into the broader WordPress page. No public exploit identified at time of analysis, and the plugin is not in CISA KEV.
Stored cross-site scripting in the GhozyLab Image Slider Widget WordPress plugin (versions through 1.1.130) lets an authenticated low-privilege user - a contributor or author able to submit content - inject script into slider fields that executes in the browser of any administrator or editor who later views the rendered slider. CVSS 3.1 rates this 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting mandatory authentication (PR:L), required victim interaction (UI:R), and scope change because the payload escapes the plugin's context into the broader WordPress page. No public exploit identified at time of analysis, and the plugin is not in CISA KEV.