Filtered by vendor Nextendweb Subscriptions
Total 9 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-0660 1 Nextendweb 1 Smart Slider 3 2024-11-21 5.4 Medium
The Smart Slider 3 WordPress plugin before 3.5.1.14 does not properly validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVE-2022-45845 1 Nextendweb 1 Smart Slider 3 2024-11-21 4.3 Medium
Deserialization of Untrusted Data vulnerability in Nextend Smart Slider 3.This issue affects Smart Slider 3: from n/a through 3.5.1.9.
CVE-2022-45843 1 Nextendweb 1 Smart Slider 3 2024-11-21 5.4 Medium
Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Nextend Smart Slider 3 plugin <= 3.5.1.9 versions.
CVE-2022-3357 1 Nextendweb 1 Smart Slider 3 2024-11-21 8.8 High
The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PHP object injection issues when a user import (intentionally or not) a malicious file, and a suitable gadget chain is present on the site.
CVE-2021-24382 1 Nextendweb 1 Smart Slider 2024-11-21 5.4 Medium
The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed.
CVE-2015-4557 1 Nextendweb 1 Nextend Twitter Connect 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter. NOTE: this may overlap CVE-2015-4413.
CVE-2015-4413 1 Nextendweb 1 Facebook Connect 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook-connect.php in Nextend Facebook Connect plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter.
CVE-2014-8800 1 Nextendweb 1 Nextend Facebook Connect 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fb_login_button parameter in a newfb_update_options action.
CVE-2024-9893 1 Nextendweb 1 Nextend Social Login Pro 2024-10-16 9.8 Critical
The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.1.14. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.