CVE-2024-13627

MEDIUMNuclei

WP Touch Slider <= 2.2 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-13627 has a selected CVSS score of 4.7 (medium); EIP currently links 1 Nuclei template.

Description

The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 19, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

OWL Carousel Slider

Default status: affected

CVE ListThrough 2.2affected

Nuclei templates

1
ProjectDiscoveryMEDIUMOWL Carousel Slider - Cross-Site ScriptingCVSS 4.7

OWL Carousel Slider WordPress plugin v2.2 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craft malicious URL.

Impact

Attackers can execute arbitrary scripts in the context of high privilege users, potentially leading to account compromise or data theft.

Remediation

Update to the latest version of the plugin where the issue is fixed or apply security patches that sanitize and escape parameters properly.

WeaknessesCWE-79
AuthorsSourabh-Sahu
Template tagscvecve2024wp-scanwp-pluginwp-buyowl-carousel-slider
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CPE: cpe:2.3:a:wp-buy:owl_carousel_slider:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/f7e425a1-ae49-4ea6-abe4-42ba2713af8f/

Source: ProjectDiscovery

References

2