CVE-2021-24382: nextendweb smart slider

csirt@kutim:~/threat-intel/cve/CVE-2021-24382

CVSS 5.4 · Medium EPSS 0,68%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada nextendweb smart slider. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed.

Rincian

Terbit di NVD: 14 Juni 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,68% peluang dieksploitasi; lebih tinggi dari 50,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
nextendweb	smart slider	Versi 3.0 hingga sebelum 3.5.0.9

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://smartslider.helpscoutdocs.com/article/1746-changelog patch · advisory vendor
https://wpscan.com/vulnerability/7b32a282-e51f-4ee5-b59f-5ba10e62a54d exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.