CVE-2015-1436

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parameter in the (1) easingslider_manage_customizations or (2) easingslider_edit_sliders page to wp-admin/admin.php.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/130355/WordPress-Easing-Slider-2.2.0.6-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/534680/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/72572Exploit, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/100861VDB Entry
https://wordpress.org/plugins/easing-slider/changelog/Patch, Release Notes
https://www.htbridge.com/advisory/HTB23249Exploit
http://packetstormsecurity.com/files/130355/WordPress-Easing-Slider-2.2.0.6-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/534680/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/72572Exploit, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/100861VDB Entry
https://wordpress.org/plugins/easing-slider/changelog/Patch, Release Notes
https://www.htbridge.com/advisory/HTB23249Exploit

Timeline

Published: Feb 16, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-14374.3Multiple cross-site scripting (XSS) vulnerabilities in Asus RT-N10+ D1 router with firmware 2.1.1.1.70 allow remote attackers to inject arbi CVE-2015-14387.8Heap-based buffer overflow in Panda Security Kernel Memory Access Driver 1.0.0.13 allows attackers to execute arbitrary code with kernel pri CVE-2015-14417.5SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary CVE-2015-14427.5SQL injection vulnerability in views/zero_transact_user.php in the administrative backend in ZeroCMS 1.3.3, 1.3.2, and earlier allows remote CVE-2015-14438.8The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code.CVE-2015-14444.3Multiple cross-site scripting (XSS) vulnerabilities in the web administration frontend in the httpd package in fli4l before 3.10.1 and 4.0 b CVE-2015-14457.2HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30.CVE-2015-144810.0The integrated management service on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware bef CVE-2015-144910.0Buffer overflow in the integrated web server on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with f CVE-2015-14507.5SQL injection vulnerability in Restaurant Biller allows remote attackers to execute arbitrary SQL commands via the cid parameter in a catego CVE-2015-14513.5Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject ar CVE-2015-14527.8The Control and Provisioning of Wireless Access Points (CAPWAP) daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to