{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-28T05:38:57.940","vulnerabilities":[{"cve":{"id":"CVE-2021-24382","sourceIdentifier":"contact@wpscan.com","published":"2021-06-14T14:15:09.117","lastModified":"2026-06-17T03:39:56.083","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed."},{"lang":"es","value":"Los plugins Smart Slider 3 Free y pro de WordPress versiones anteriores a 3.5.0.9, no saneaban el Nombre del Proyecto antes de devolverlo a la página, conllevando un problema de tipo Cross-Site Scripting almacenado. Por defecto, sólo los usuarios administradores podían acceder a la funcionalidad afectada, limitando la posibilidad de explotar la vulnerabilidad. Sin embargo, algunos administradores de WordPress pueden permitir a usuarios menos privilegiados acceder a la funcionalidad del plugin, en cuyo caso, una escalada de privilegios podría ser llevada a cabo"}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Nextend","product":"Smart Slider 3","versions":[{"version":"3.5.0.9","lessThan":"3.5.0.9","versionType":"custom","status":"affected"}]},{"vendor":"Nextend","product":"Smart Slider 3","versions":[{"version":"3.5.0.9","lessThan":"3.5.0.9","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"contact@wpscan.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nextendweb:smart_slider:*:*:*:*:free:wordpress:*:*","versionStartIncluding":"3.0","versionEndExcluding":"3.5.0.9","matchCriteriaId":"C8A259CF-BC57-45E4-BEE3-FE966D605A1F"},{"vulnerable":true,"criteria":"cpe:2.3:a:nextendweb:smart_slider:*:*:*:*:pro:wordpress:*:*","versionStartIncluding":"3.0","versionEndExcluding":"3.5.0.9","matchCriteriaId":"6A757625-7C17-40D5-AF79-684450ECE021"}]}]}],"references":[{"url":"https://smartslider.helpscoutdocs.com/article/1746-changelog","source":"contact@wpscan.com","tags":["Patch","Vendor Advisory"]},{"url":"https://wpscan.com/vulnerability/7b32a282-e51f-4ee5-b59f-5ba10e62a54d","source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://smartslider.helpscoutdocs.com/article/1746-changelog","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"https://wpscan.com/vulnerability/7b32a282-e51f-4ee5-b59f-5ba10e62a54d","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}}]}