LayerSlider vulnerabilities

Products

• LayerSlider 4

Latest LayerSlider CVEs

Newest publication first

1. CVE-2024-4575 LayerSlider 7.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ls_search_form Shortcode

   Published 2024-05-23

   Medium·CVSS 6.4 EPSS 0.27%

   The LayerSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ls_search_form shortcode in version 7.11.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

2. CVE-2024-2879 LayerSlider 7.9.11 - 7.10.0 - Unauthenticated SQL Injection

   Published 2024-04-03

   High·CVSS 7.5 EPSS 18.4%

   The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...

3. CVE-2023-47786 WordPress LayerSlider Plugin <= 7.7.9 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-11-22

   Medium·CVSS 5.4 EPSS 0.37%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LayerSlider plugin <= 7.7.9 versions.

4. CVE-2023-47785 WordPress LayerSlider Plugin <= 7.7.9 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-11-22

   High·CVSS 8.8 EPSS 0.25%

   Cross-Site Request Forgery (CSRF) vulnerability in LayerSlider plugin <= 7.7.9 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.