Slide Anything < 2.3.47 - Author+ Cross Site Scripting in slide title

Vulnerability

The Slide Anything WordPress plugin before version 2.3.47 does not properly sanitize or escape the slide title before outputting it in admin pages. This allows a logged-in user with roles as low as Author to inject arbitrary JavaScript payloads into the slide title, even when the unfiltered_html capability is disabled [1].

Exploitation

An attacker must have an Author-level account or higher on the WordPress site. The attacker creates or edits a slide and inserts a malicious JavaScript payload into the slide title. When the slide title is displayed in the admin pages, the payload executes in the context of the administrator's session [1].

Impact

Successful exploitation leads to stored cross-site scripting (XSS) in the WordPress admin area. This can result in session hijacking, defacement, or further privilege escalation attacks against site administrators [1].

Mitigation

The issue is fixed in version 2.3.47 of the Slide Anything plugin. Users should update to this version immediately. If updating is not possible, consider restricting Author-level permissions or disabling the plugin [1].