CVE-2021-24196— Social Slider Widget < 1.8.5 - Authenticated Reflected Cross-Site Scripting (XSS)
Quick assessment
Affected
Unknown Social Slider Widget
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress是WordPress（Wordpress）基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 WordPress 插件Social Slider Widget 1.8.5之前版本在插件设置页面中存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-24196
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Social Slider Widget < 1.8.5 - Authenticated Reflected Cross-Site Scripting (XSS)
Source: CVE Program / CVE List V5
Vulnerability Description
The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress是WordPress（Wordpress）基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 WordPress 插件Social Slider Widget 1.8.5之前版本在插件设置页面中存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Social Slider Widget | 1.8.5 ~ 1.8.5 | - |
|
II. Public POCs for CVE-2021-24196
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-24196
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-24196 (1)
-
https://wpscan.com/vulnerability/bb20d732-a5e4-4140-ab51-b2aa1a53db12 x_refsource_CONFIRM
Security Blog Posts for CVE-2021-24196 (1)
Same Patch Batch · Unknown · 2021-04-05 · 45 CVEs total
| CVE-2021-24164 | Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key Disclosure | |
| CVE-2021-24167 | Web-Stat < 1.4.1 - API Key Disclosure | |
| CVE-2021-24166 | Ninja Forms < 3.4.34 - CSRF to OAuth Service Disconnection | |
| CVE-2021-24150 | Like Button Rating < 2.6.32 - Unauthenticated Full-Read SSRF | |
| CVE-2021-24154 | Theme Editor < 2.6 - Authenticated Arbitrary File Download | |
| CVE-2021-24155 | Backup Guard < 1.6.0 - Authenticated Arbitrary File Upload | |
| CVE-2021-24156 | Testimonial Rotator <= 3.0.3 - Authenticated Stored Cross-Site Scripting | |
| CVE-2021-24157 | Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site Scripting | |
| CVE-2021-24158 | Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation | |
| CVE-2021-24153 | Yoast SEO < 3.4.1 - Authenticated Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24165 | Ninja Forms < 3.4.34 - Administrator Open Redirect | |
| CVE-2021-24163 | Ninja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key Disc | |
| CVE-2021-24159 | Contact Form 7 Style <= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting | |
| CVE-2021-24176 | JH 404 Logger <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24175 | The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass | |
| CVE-2021-24174 | Database Backups <= 1.2.2.6 - CSRF to Backup Download | |
| CVE-2021-24173 | VM Backups <= 1.0 - CSRF to Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24172 | VM Backups <= 1.0 - CSRF to Database Backup Download | |
| CVE-2021-24171 | WooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File Upload | |
| CVE-2021-24170 | User Profile Picture < 2.5.0 - Sensitive Information Disclosure |
Showing top 20 of 45 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-78146
Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_ -
CVE-2026-77695
Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest -
CVE-2026-77757
Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move v -
CVE-2026-77758
Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticate -
CVE-2026-77789
Stripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer
Same weakness: CWE-79
-
CVE-2026-2388
Reviews and Rating – Google Reviews <= 5.10 - Authenticated -
CVE-2026-6178
Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross- -
CVE-2026-18331
Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Si -
CVE-2026-3002
Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cr -
CVE-2026-19760
WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Sit
V. Comments for CVE-2021-24196
No comments yet