CVE-2024-5649

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Universal Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.5 via deserialization of untrusted input 'fsl_get_gallery_value' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Jun 19, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-564933.3IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This informa CVE-2024-564943.3IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This informa CVE-2024-564953.3IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This informa CVE-2024-564963.3IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This informa CVE-2024-564976.7An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiMail versions 7.2.0 through 7 CVE-2024-56508.5DLL Hijacking vulnerability has been found in CENTUM CAMS Log server provided by Yokogawa Electric Corporation. If an attacker is somehow ab CVE-2024-565075.4LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a reflected cross-site scripting (XSS) vulnera CVE-2024-565087.6LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a file upload vulnerability exists in the Link CVE-2024-565098.6changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Improper inpu CVE-2024-56518.8A flaw was found in the Fence Agents Remediation operator. This vulnerability can allow a Remote Code Execution (RCE) primitive by supplying CVE-2024-565105.3@marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown. Marp Core from v3.0.2 to v CVE-2024-565119.8DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.