CVE-2024-3027

The Smart Slider 3 plugin through version 3.5.1.22 fails to properly verify user permissions before allowing file uploads, permitting contributors and higher-privileged users to upload files such as SVG images that can execute stored cross-site scripting attacks. This capability check absence enables authenticated attackers to modify data and inject malicious content into the WordPress site.

Based on public CVE data (MITRE/NVD).