cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2024-3027,https://securityvulnerability.io/vulnerability/CVE-2024-3027,Unauthorized Data Modification Vulnerability in Smart Slider 3 Plugin,"The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all versions up to, and including, 3.5.1.22. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files, including SVG files, which can be used to conduct stored cross-site scripting attacks.",Wordpress,Smart Slider 3,6.4,MEDIUM,0.0004299999854993075,false,,false,false,false,,false,false,2024-04-13T01:57:49.676Z,0
CVE-2023-0660,https://securityvulnerability.io/vulnerability/CVE-2023-0660,Smart Slider 3 < 3.5.1.14 - Contributor+ Stored XSS,"The Smart Slider 3 WordPress plugin before 3.5.1.14 does not properly validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks",Wordpress,Smart Slider 3,5.4,MEDIUM,0.000539999979082495,false,,false,false,false,,false,false,2023-03-27T16:15:00.000Z,0
CVE-2022-3357,https://securityvulnerability.io/vulnerability/CVE-2022-3357,Smart Slider 3 < 3.5.1.11 - PHP Object Injection,"The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PHP object injection issues when a user import (intentionally or not) a malicious file, and a suitable gadget chain is present on the site.",Wordpress,Smart Slider 3,8.8,HIGH,0.0011399999493733048,false,,false,false,false,,false,false,2022-10-31T00:00:00.000Z,0
CVE-2021-24382,https://securityvulnerability.io/vulnerability/CVE-2021-24382,Smart Slider 3 < 3.5.0.9 - Authenticated Stored Cross-Site Scripting (XSS),"The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed.",Wordpress,Smart Slider 3,5.4,MEDIUM,0.000539999979082495,false,,false,false,false,,false,false,2021-06-14T13:37:14.000Z,0