slidervilla vulnerabilities

Products

• testimonial slider 4
• smooth slider 2
• dbox slider 1

Latest slidervilla CVEs

Newest publication first

1. CVE-2024-1745 Testimonial Slider < 2.3.7 - Author+ Settings Update

   Published 2024-03-26

   Medium·CVSS 4.3 EPSS 0.38%

   The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial Slider WordPress plugin before 2.3.7 settings, making it possible for users with at least the Author role to edit them.

2. CVE-2022-44741 WordPress Testimonial Slider plugin <= 1.3.1 - Cross-Site Request Forgery (CSRF) vulnerability

   Published 2022-11-08

   High·CVSS 8.8 EPSS 0.40%

   Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress.

3. CVE-2015-9454 Smooth Slider < 2.7 - Authenticated SQL Injection

   Published 2019-10-07

   High·CVSS 8.8 EPSS 1.9%

   The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.

4. CVE-2015-9417 Testimonial Slider <= 1.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

   Published 2019-09-25

   Medium·CVSS 6.5 EPSS 0.67%

   The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.

5. CVE-2018-5374 Dbox 3D Slider Lite <= 1.2.2 - SQL Injection

   Published 2018-01-12

   High·CVSS 8.8 EPSS 1.2%

   The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).

6. CVE-2018-5373 Smooth Slider < 2.8.7 - Authenticated SQL Injection

   Published 2018-01-12

   High·CVSS 8.8 EPSS 1.2%

   The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php (trid parameter).

7. CVE-2018-5372 Testimonial Slider < 1.2.5 - SQL Injection

   Published 2018-01-12

   High·CVSS 8.8 EPSS 1.2%

   The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.