CVE-2021-24557

The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
WPScanCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 67%
VendorProductVersion
nimble3m-vslider
𝑥
≤ 2.1.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://codevigilant.com/disclosure/2021/wp-plugin-m-vslider/
https://wpscan.com/vulnerability/8b8e41e8-5a40-4062-b5b7-3b01b1a709ef
https://codevigilant.com/disclosure/2021/wp-plugin-m-vslider/
https://wpscan.com/vulnerability/8b8e41e8-5a40-4062-b5b7-3b01b1a709ef