CVE-2024-11731

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slider shortcode in all versions up to, and including, 3.10.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This issue was partially fixed in version 3.10.8.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 5, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-117326.5The BP Profile Shortcodes Extra plugin for WordPress is vulnerable to time-based SQL Injection via the ‘tab’ parameter in all versions up to CVE-2024-117337.3The The WordPress Popular Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.CVE-2024-117346.5A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to d CVE-2024-117364.9A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through u CVE-2024-117379.8CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidentiality, integrity of th CVE-2024-117387.5A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello me CVE-2024-117399.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Case Informatics Case ERP allows SQL I CVE-2024-11748.2Previous versions of HP ThinPro (prior to HP ThinPro 8.0 SP 8) could potentially contain security vulnerabilities. HP has released HP ThinPr CVE-2024-117407.3The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. T CVE-2024-117414.3Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected CVE-2024-117425.4A vulnerability, which was classified as problematic, has been found in SourceCodester Best House Rental Management System 1.0. This issue a CVE-2024-117434.3A vulnerability, which was classified as problematic, was found in SourceCodester Best House Rental Management System 1.0. Affected is an un