CVE-2015-3634

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-06-08 · updated 2026-06-17
Weakness: CWE-200

Description

The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to read arbitrary Wordpress option values.

Affected products

Slideshow: 2.2.8, 2.2.9, 2.2.10, 2.2.11, 2.2.12, 2.2.13 (+8)

References

http://www.openwall.com/lists/oss-security/2015/05/02/12
http://www.securityfocus.com/bid/74453
https://github.com/Boonstra/Slideshow/commit/cac505e593cbe70a4d8af5b639f5385d4cc7aa04
https://wordpress.org/plugins/slideshow-jquery-image-gallery/#developers
http://www.openwall.com/lists/oss-security/2015/05/02/12
http://www.securityfocus.com/bid/74453
https://github.com/Boonstra/Slideshow/commit/cac505e593cbe70a4d8af5b639f5385d4cc7aa04
https://wordpress.org/plugins/slideshow-jquery-image-gallery/#developers

Get alerted when CVE-2015-3634 or the next vulnerability affects your stack