i13websolution Thumbnail Carousel Slider

Responsive Thumbnail Slider < 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload

The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the deleteselected function. This makes it possible for unauthenticated attackers to delete sliders in bulk via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Thumbnail carousel slider <= 1.1.9 - Reflected Cross-Site Scripting

Thumbnail carousel slider < 1.1.10 - Reflected XSS

Thumbnail carousel slider <= 1.0.4 - Authenticated (Admin+) SQL Injection