Smart Slider 3 vulnerabilities

The Smart Slider 3 plugin for WordPress up to version 3.5.1.38 is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slider' Block Attribute in all versions up to and including 3.5.1.38 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page. The scripts execute specifically when a user opens the affected post in the WordPress block editor, making Editors and Administrators the primary targets.

The Smart Slider 3 plugin for WordPress up to version 3.5.1.37 inclusive is vulnerable to Sensitive Information Exposure via the 'keyword' parameter. This allows authenticated attackers with contributor-level access or higher to extract titles and full content excerpts of private, draft, pending, trashed, and auto-draft posts from any user, including Administrators and Editors.

The Smart Slider 3 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.1.36 via the replaceHTMLImage function. This allows authenticated attackers with administrator-level access or above to read the contents of arbitrary files on the server, which may contain sensitive information.

The Smart Slider 3 plugin for WordPress up to version 3.5.1.33 fails to check proper capabilities in multiple AJAX controller actions. Missing checkForCap() and validatePermission() calls allow authenticated attackers with Contributor-level access and above to enumerate slider metadata and create, modify, and delete image storage records.