Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2024-3020

Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Admin+) PHP Object Injection

The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the 'shortcode' parameter. This allows authenticated attackers, with administrator-level access to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Shapedplugin
Products
Logo Carousel Post Grid\, Post Carousel\, \& List Category Posts Product Slider For Woocommerce
CVE-2021-24739

Logo Carousel < 3.4.2 - Unauthorised Private Post Access

The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature

CVSS 3.1 · 8.1 High EPSS 1.0% KEV · Not listed
Vendors
Shapedplugin
Products
Logo Carousel
CVE-2021-24738

Logo Carousel < 3.4.2 - Contributor+ Stored Cross-Site Scripting

The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Shapedplugin
Products
Logo Carousel