Medium severity · published May 24, 2021
CVE-2021-24300
The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to…
6.1
CVSS
10.6%
EPSS
No
On KEV
Description
The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)10.6% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PS
Product Slider For Woocommerce · Pickplugins
before 1.13.22 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24300
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24300
Exploit
https://wpscan.com/vulnerability/5fbbc7ad-3f1a-48a1-b2eb-e57f153eb837
More from Product Slider For Woocommerce
6.5
CVE-2026-25455
WordPress Product Slider for WooCommerce plugin <= 1.13.61 - Broken Access Control vulnerability
6.1
CVE-2024-45459
WordPress Product Slider for WooCommerce by PickPlugins plugin <= 1.13.50 - Reflected Cross Site Scripting (XSS) vulnerability
5.4
CVE-2023-0166
The Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of its shortcode attributes before outputting them back in a…
4.3
CVE-2026-65456
WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability