¿Es seguro Layerslider?

Qué hace este plugin

• Slug: LayerSlider

Estado de mantenimiento

Vulnerabilidades conocidas

5 CVEs conocidos registrados para Layerslider. Reportadas entre 2014 y 2024.

CVE-2024-4575

The LayerSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ls_search_form shortcode in version 7.11.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-2879

Update the WordPress LayerSlider plugin to the latest available version (at least 7.10.1). AmrAwad discovered and reported this SQL Injection vulnerability in WordPress LayerSlider Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information. This vulnerability has been fixed in version 7.10.1. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-47786

Update the WordPress LayerSlider plugin to the latest available version (at least 7.7.10). Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress LayerSlider Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 7.7.10.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-47785

Update the WordPress LayerSlider plugin to the latest available version (at least 7.7.10). Rafie Muhammad (Patchstack) discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress LayerSlider Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 7.7.10.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2022-1153

The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

LayerSlider [LayerSlider] < 6.2.1

The Cross-site Request Forgery (CSRF) vulnerability found by WPHutte in WordPress LayerSlider plugin version 6.2.0 and this vulnerability could lead to Cross-Site Scripting (XSS) and SQL Injection vulnerabilities. Update the WordPress LayerSlider plugin to the latest available version (at least version 6.2.1).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

LayerSlider [LayerSlider] < 6.2.1

The LayerSlider plugin for WordPress is vulnerable to Cross-Site Request forgery in versions up to, and including 6.2.0, due missing nonce validation on an unspecified function that makes it possible for attackers to trick site administrators into performing unwanted actions.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

LayerSlider [LayerSlider] < 6.2.1

The LayerSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.2.0. This is due to missing or incorrect nonce validation on the ls_save_screen_options() function. This makes it possible for authenticated attackers to create an administrative account via XSS, which the attacker can use to perform SQLi attacks. Assuming they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

+ 7 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	LayerSlider [LayerSlider] < 5.2.0	—	Desconocido	< 5.2.0	5.2.0	2014-08-01	—
—	LayerSlider [LayerSlider] < 5.2.0	—	Desconocido	< 5.2.0	5.2.0	2014-08-01	—
—	LayerSlider [LayerSlider] < 5.2.0	—	Desconocido	< 5.2.0	5.2.0	2014-08-01	—
—	LayerSlider [LayerSlider] < 5.2.0	—	Desconocido	< 5.2.0	5.2.0	2014-08-01	—
—	LayerSlider [LayerSlider] < 6.2.1	—	Desconocido	< 6.2.1	6.2.1	—	—
—	LayerSlider [LayerSlider] < 5.2.0	—	Desconocido	< 5.2.0	5.2.0	—	—
—	LayerSlider [LayerSlider] < 5.2.0	—	Desconocido	< 5.2.0	5.2.0	—	—

LayerSlider [LayerSlider] < 5.2.0

Este plugin es susceptible a una vulnerabilidad de falsificación de solicitudes entre sitios (CSRF). Actualice el plugin.

Traducción automática del texto original de la fuente. Ver original

Fuente: Patchstack

LayerSlider [LayerSlider] < 5.2.0

This plugin is prone to a remote path traversal file access. It allows arbitrary code execution. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

LayerSlider [LayerSlider] < 5.2.0

The LayerSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.6.1. This is due to missing or incorrect nonce validation on the style editing functions in the settings page. This makes it possible for unauthenticated attackers to gain unauthorized admin privileges, actions, and/or access via forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

LayerSlider [LayerSlider] < 5.2.0

The LayerSlider plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 4.6.1 via the LayerSlider/editor.php skin parameter. This allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

LayerSlider [LayerSlider] < 6.2.1

The LayerSlider WordPress plugin was affected by a CSRF / Authenticated Stored XSS & SQL Injection security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

LayerSlider [LayerSlider] < 5.2.0

The LayerSlider WordPress plugin was affected by a Remote Path Traversal File Access security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

LayerSlider [LayerSlider] < 5.2.0

The LayerSlider WordPress plugin was affected by a Style Editing CSRF security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.