PLUGIN SECURITY
This plugin will remove the version info appended to enqueued style and script urls along with Meta Generator in the head section and in RSS feeds.
LayerSlidermetameta generatorremovesecurityversion
5 known CVEs on file for Layerslider. Reported between 2014 and 2024.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-4575 | LayerSlider [LayerSlider] < 7.11.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 7.11.1 | 7.11.1 | 2024-05-22 | — |
| CVE-2024-2879 | LayerSlider [LayerSlider] < 7.10.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 7.10.1 | 7.10.1 | 2024-04-02 | — |
| CVE-2023-47786 | LayerSlider [LayerSlider] < 7.7.10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 7.7.10 | 7.7.10 | 2023-11-14 | — |
| CVE-2023-47785 | LayerSlider [LayerSlider] < 7.7.10 | Cross-Site Request Forgery (CSRF) | High 7.1 | < 7.7.10 | 7.7.10 | 2023-11-14 | — |
| CVE-2022-1153 | LayerSlider [LayerSlider] < 7.1.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 7.1.2 | 7.1.2 | 2022-03-29 | — |
| — | LayerSlider [LayerSlider] < 6.2.1 | — | Unknown | < 6.2.1 | 6.2.1 | 2017-05-16 | — |
| — | LayerSlider [LayerSlider] < 6.2.1 | — | Unknown | < 6.2.1 | 6.2.1 | 2017-03-28 | — |
| — | LayerSlider [LayerSlider] < 6.2.1 | — | Unknown | < 6.2.1 | 6.2.1 | 2017-03-28 | — |
The LayerSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ls_search_form shortcode in version 7.11.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Source: CVE.org
Update the WordPress LayerSlider plugin to the latest available version (at least 7.10.1). AmrAwad discovered and reported this SQL Injection vulnerability in WordPress LayerSlider Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information. This vulnerability has been fixed in version 7.10.1. Have additional information or questions about this entry? Get in touch.
Source: Patchstack
Update the WordPress LayerSlider plugin to the latest available version (at least 7.7.10). Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress LayerSlider Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 7.7.10.
Source: Patchstack
Update the WordPress LayerSlider plugin to the latest available version (at least 7.7.10). Rafie Muhammad (Patchstack) discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress LayerSlider Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 7.7.10.
Source: Patchstack
The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Source: CVE.org
The Cross-site Request Forgery (CSRF) vulnerability found by WPHutte in WordPress LayerSlider plugin version 6.2.0 and this vulnerability could lead to Cross-Site Scripting (XSS) and SQL Injection vulnerabilities. Update the WordPress LayerSlider plugin to the latest available version (at least version 6.2.1).
Source: Patchstack
The LayerSlider plugin for WordPress is vulnerable to Cross-Site Request forgery in versions up to, and including 6.2.0, due missing nonce validation on an unspecified function that makes it possible for attackers to trick site administrators into performing unwanted actions.
Source: Wordfence
The LayerSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.2.0. This is due to missing or incorrect nonce validation on the ls_save_screen_options() function. This makes it possible for authenticated attackers to create an administrative account via XSS, which the attacker can use to perform SQLi attacks. Assuming they can trick a site administrator into performing an action such as clicking on a link.
Source: Wordfence
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| — | LayerSlider [LayerSlider] < 5.2.0 | — | Unknown | < 5.2.0 | 5.2.0 | 2014-08-01 | — |
| — | LayerSlider [LayerSlider] < 5.2.0 | — | Unknown | < 5.2.0 | 5.2.0 | 2014-08-01 | — |
| — | LayerSlider [LayerSlider] < 5.2.0 | — | Unknown | < 5.2.0 | 5.2.0 | 2014-08-01 | — |
| — | LayerSlider [LayerSlider] < 5.2.0 | — | Unknown | < 5.2.0 | 5.2.0 | 2014-08-01 | — |
| — | LayerSlider [LayerSlider] < 6.2.1 | — | Unknown | < 6.2.1 | 6.2.1 | — | — |
| — | LayerSlider [LayerSlider] < 5.2.0 | — | Unknown | < 5.2.0 | 5.2.0 | — | — |
| — | LayerSlider [LayerSlider] < 5.2.0 | — | Unknown | < 5.2.0 | 5.2.0 | — | — |
This plugin is prone to a cross site request forgery vulnerability. Update the plugin.
Source: Patchstack
This plugin is prone to a remote path traversal file access. It allows arbitrary code execution. Update the plugin.
Source: Patchstack
The LayerSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.6.1. This is due to missing or incorrect nonce validation on the style editing functions in the settings page. This makes it possible for unauthenticated attackers to gain unauthorized admin privileges, actions, and/or access via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Source: Wordfence
The LayerSlider plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 4.6.1 via the LayerSlider/editor.php skin parameter. This allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Source: Wordfence
The LayerSlider WordPress plugin was affected by a CSRF / Authenticated Stored XSS & SQL Injection security vulnerability.
Source: WPScan
The LayerSlider WordPress plugin was affected by a Remote Path Traversal File Access security vulnerability.
Source: WPScan
The LayerSlider WordPress plugin was affected by a Style Editing CSRF security vulnerability.
Source: WPScan
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.