CVE-2024-1712

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

The Carousel Slider WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Carousel Slider	< 2.2.7
majeedraza	carousel_slider	< 2.2.7

References

https://wpscan.com/vulnerability/23805a61-9fcd-4744-a60d-05c8cb43ee01/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/23805a61-9fcd-4744-a60d-05c8cb43ee01/Exploit, Third Party Advisory

Timeline

Published: Apr 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-17137.2A user who can create objects in a database with plv8 3.2.1 installed is able to cause deferred triggers to execute as the Superuser during CVE-2024-17147.1An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading CVE-2024-17164.3The Admin Bar Remover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updat CVE-2024-17174.3The Admin Notices Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_CVE-2024-17185.3The Claudio Sanches – Checkout Cielo for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to insuffic CVE-2024-17194.3The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin CVE-2024-17206.1The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored CVE-2024-17215.6Improper Verification of Cryptographic Signature vulnerability in HYPR Passwordless on Windows allows Malicious Software Update.This issue a CVE-2024-17225.3A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from log CVE-2024-17235.4The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to CVE-2024-17248.2In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/b CVE-2024-17256.5A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authentic