CVE-2015-3634

moderate-risk

Published 2017-06-08

The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to read arbitrary Wordpress option values.

Do I need to act?

2.1% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (14)

Slideshow

Affected Vendors

Slideshow Project

References (8)

Mailing List http://www.openwall.com/lists/oss-security/2015/05/02/12

Third Party Advisory http://www.securityfocus.com/bid/74453

Patch https://github.com/Boonstra/Slideshow/commit/cac505e593cbe70a4d8af5b639f5385d4cc...

Release Notes https://wordpress.org/plugins/slideshow-jquery-image-gallery/#developers

Mailing List http://www.openwall.com/lists/oss-security/2015/05/02/12

Third Party Advisory http://www.securityfocus.com/bid/74453

Patch https://github.com/Boonstra/Slideshow/commit/cac505e593cbe70a4d8af5b639f5385d4cc...

Release Notes https://wordpress.org/plugins/slideshow-jquery-image-gallery/#developers

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 5/34 · Minimal

Exposure 18/34 · Moderate