{"containers": {"cna": {"affected": [{"product": "Smart Slider 3", "vendor": "Nextend", "versions": [{"lessThan": "3.5.0.9", "status": "affected", "version": "3.5.0.9", "versionType": "custom"}]}, {"product": "Smart Slider 3", "vendor": "Nextend", "versions": [{"lessThan": "3.5.0.9", "status": "affected", "version": "3.5.0.9", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Hardik Solanki"}, {"lang": "en", "value": "blackangel"}], "descriptions": [{"lang": "en", "value": "The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-06-14T13:37:14", "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://wpscan.com/vulnerability/7b32a282-e51f-4ee5-b59f-5ba10e62a54d"}, {"tags": ["x_refsource_MISC"], "url": "https://smartslider.helpscoutdocs.com/article/1746-changelog"}], "source": {"discovery": "UNKNOWN"}, "title": "Smart Slider 3 < 3.5.0.9 - Authenticated Stored Cross-Site Scripting (XSS)", "x_generator": "WPScan CVE Generator", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "contact@wpscan.com", "ID": "CVE-2021-24382", "STATE": "PUBLIC", "TITLE": "Smart Slider 3 < 3.5.0.9 - Authenticated Stored Cross-Site Scripting (XSS)"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Smart Slider 3", "version": {"version_data": [{"version_affected": "<", "version_name": "3.5.0.9", "version_value": "3.5.0.9"}]}}, {"product_name": "Smart Slider 3", "version": {"version_data": [{"version_affected": "<", "version_name": "3.5.0.9", "version_value": "3.5.0.9"}]}}]}, "vendor_name": "Nextend"}]}}, "credit": [{"lang": "eng", "value": "Hardik Solanki"}, {"lang": "eng", "value": "blackangel"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed."}]}, "generator": "WPScan CVE Generator", "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://wpscan.com/vulnerability/7b32a282-e51f-4ee5-b59f-5ba10e62a54d", "refsource": "CONFIRM", "url": "https://wpscan.com/vulnerability/7b32a282-e51f-4ee5-b59f-5ba10e62a54d"}, {"name": "https://smartslider.helpscoutdocs.com/article/1746-changelog", "refsource": "MISC", "url": "https://smartslider.helpscoutdocs.com/article/1746-changelog"}]}, "source": {"discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "cveId": "CVE-2021-24382", "datePublished": "2021-06-14T13:37:14", "dateReserved": "2021-01-14T00:00:00", "dateUpdated": "2021-06-14T13:37:14", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nextendweb:smart_slider:*:*:*:*:free:wordpress:*:*", "matchCriteriaId": "C8A259CF-BC57-45E4-BEE3-FE966D605A1F", "versionEndExcluding": "3.5.0.9", "versionStartIncluding": "3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextendweb:smart_slider:*:*:*:*:pro:wordpress:*:*", "matchCriteriaId": "6A757625-7C17-40D5-AF79-684450ECE021", "versionEndExcluding": "3.5.0.9", "versionStartIncluding": "3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed."}, {"lang": "es", "value": "Los plugins Smart Slider 3 Free y pro de WordPress versiones anteriores a 3.5.0.9, no saneaban el Nombre del Proyecto antes de devolverlo a la p\u00e1gina, conllevando un problema de tipo Cross-Site Scripting almacenado. Por defecto, s\u00f3lo los usuarios administradores pod\u00edan acceder a la funcionalidad afectada, limitando la posibilidad de explotar la vulnerabilidad. Sin embargo, algunos administradores de WordPress pueden permitir a usuarios menos privilegiados acceder a la funcionalidad del plugin, en cuyo caso, una escalada de privilegios podr\u00eda ser llevada a cabo"}], "id": "CVE-2021-24382", "lastModified": "2021-06-22T20:09:47.200", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-06-14T14:15:09.117", "references": [{"source": "contact@wpscan.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://smartslider.helpscoutdocs.com/article/1746-changelog"}, {"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/7b32a282-e51f-4ee5-b59f-5ba10e62a54d"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "contact@wpscan.com", "type": "Primary"}]}

{}