GHSA-g6hx-qvw2-39jx
GitHub Security Advisory
⚠ Unreviewed
MODERATE
Has CVE
Advisory Details
The LayerSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ls_search_form shortcode in version 7.11.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: July 29, 2025 6:37 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.