Threats tagged 'ghsa-mrw5-7p4v-67jq'

The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'delay' post meta setting. This affects all versions up to and including 3.111.0. Authenticated users with custom-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, combined with inadequate capability restrictions on the ml-slider custom post type and unprotected meta keys.