What’s Vulnerable › Vulnerabilities

CVE-2021-24196: Social Slider Widget < 1.8.5 - Authenticated Reflected Cross-Site Scripting (XSS)

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-04-05 · updated 2026-06-17
• Weakness: CWE-79

Description

The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized

Affected products

• Social Slider Feed: before 1.8.5 — fixed in 1.8.5

How to fix

Upgrade to a fixed version: Social Slider Feed 1.8.5. Check the vendor advisory for mitigations.

References

• https://purinechu.github.io/posts/social_slider_widget_reflected_xss/
• https://wpscan.com/vulnerability/bb20d732-a5e4-4140-ab51-b2aa1a53db12
• https://purinechu.github.io/posts/social_slider_widget_reflected_xss/
• https://wpscan.com/vulnerability/bb20d732-a5e4-4140-ab51-b2aa1a53db12

Get alerted when CVE-2021-24196 or the next vulnerability affects your stack