Slider By 10Web
Monthly
Unauthenticated cross-site scripting in the Slider by 10Web WordPress plugin (slider-wd) affects all versions up to and including 1.2.63, allowing remote attackers to inject script that executes in a victim's browser session on the affected site. The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - no privileges are required to originate the payload, but exploitation is not self-propagating: it depends on a human in the loop, since the victim must open an attacker-supplied request or crafted link (UI:R) for the script to run, and the vulnerable code path is only reachable while the plugin is installed and active. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and unauthenticated attack surface make prompt patching or deactivation advisable for sites running the plugin.
Blind SQL injection in the Slider by 10Web WordPress plugin through version 1.2.63 allows an authenticated high-privilege user (CVSS PR:H, typically administrator-level) with network access to the vulnerable request handler to inferentially extract database contents, with confidentiality-only impact per the independent assessment. The input CVSS 3.1 vector describes a network-reachable, low-complexity flaw, but the high-privilege requirement is a critical mitigating factor because anonymous or unprivileged users cannot reach the vulnerable code path. No public exploit identified at time of analysis, and no CISA KEV entry or EPSS data was provided; patch availability is not confirmed from the supplied data.
Arbitrary file deletion via unauthenticated CSRF in the Slider by 10Web WordPress plugin (versions up to and including 1.2.62) enables a remote attacker to delete files on the WordPress host by tricking an authenticated administrator into visiting a malicious page. Per the Patchstack advisory title, the CSRF primitive chains directly to arbitrary file deletion, which is reflected in the CVSS 3.1 score of 7.4 (High) with Scope Changed (S:C) and High Availability impact (A:H), indicating the destruction extends beyond the plugin itself to the broader WordPress installation or filesystem. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.
Unauthenticated cross-site scripting in the Slider by 10Web WordPress plugin (slider-wd) affects all versions up to and including 1.2.63, allowing remote attackers to inject script that executes in a victim's browser session on the affected site. The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - no privileges are required to originate the payload, but exploitation is not self-propagating: it depends on a human in the loop, since the victim must open an attacker-supplied request or crafted link (UI:R) for the script to run, and the vulnerable code path is only reachable while the plugin is installed and active. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and unauthenticated attack surface make prompt patching or deactivation advisable for sites running the plugin.
Blind SQL injection in the Slider by 10Web WordPress plugin through version 1.2.63 allows an authenticated high-privilege user (CVSS PR:H, typically administrator-level) with network access to the vulnerable request handler to inferentially extract database contents, with confidentiality-only impact per the independent assessment. The input CVSS 3.1 vector describes a network-reachable, low-complexity flaw, but the high-privilege requirement is a critical mitigating factor because anonymous or unprivileged users cannot reach the vulnerable code path. No public exploit identified at time of analysis, and no CISA KEV entry or EPSS data was provided; patch availability is not confirmed from the supplied data.
Arbitrary file deletion via unauthenticated CSRF in the Slider by 10Web WordPress plugin (versions up to and including 1.2.62) enables a remote attacker to delete files on the WordPress host by tricking an authenticated administrator into visiting a malicious page. Per the Patchstack advisory title, the CSRF primitive chains directly to arbitrary file deletion, which is reflected in the CVSS 3.1 score of 7.4 (High) with Scope Changed (S:C) and High Availability impact (A:H), indicating the destruction extends beyond the plugin itself to the broader WordPress installation or filesystem. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.