CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
The Multi Item Responsive Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'mioptions.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
Multi Item Responsive Slider versions 1.0 and earlier contain a cross-site scripting vulnerability that allows attackers to inject malicious scripts. An attacker can craft a malicious link that, when visited by a site user, executes arbitrary JavaScript in the user's browser. The vulnerability affects the slider's rendering of user-supplied input without proper sanitization.
What an attacker can do
Inject and execute malicious JavaScript in visitors' browsers to steal session tokens, redirect users, or deface content.
Potential impact on your site
Visitors to your site could have their sessions hijacked, be redirected to phishing pages, or see altered content depending on attacker intent.
Conditions required to exploit
Attacker must trick a site visitor into clicking a malicious link or visiting a compromised page (user interaction required).
Key dates
External resources
