Advisories · Technology
nextendweb Smart Slider 3.
Every CVE that names nextendweb Smart Slider 3 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.4 Medium
Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block
- nextendweb Smart Slider 3
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute
- nextendweb Smart Slider 3
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter
- nextendweb Smart Slider 3
- Information disclosure
- CVSS 4.9 Medium
Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export
- nextendweb Smart Slider 3
- Path traversal
- CVSS 5.4 Medium
Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation
- nextendweb Smart Slider 3
- Broken access control
- CVSS 6.5 Medium
Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll
- nextendweb Smart Slider 3
- Broken access control
- CVSS 4.9 Medium
Smart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` Parameter
- nextendweb Smart Slider 3
- SQL injection
- CVSS 6.4 Medium
Smart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File Upload
- nextendweb Smart Slider 3
- Broken access control