Slider Revolution vulnerabilities

The Slider Revolution plugin versions 7.0.0 through 7.0.16 contain a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script into an HTTP request that will be executed in the victim's browser.

The Slider Revolution plugin for WordPress versions 7.0 to 7.0.10 allows sensitive information disclosure. Authenticated attackers with Subscriber-level access can read server files (e.g., .sql, .log, .json) by copying them to a publicly accessible directory.

The Slider Revolution plugin for WordPress versions 6.0.0-6.7.55 and 7.0.0-7.0.14 is vulnerable to unauthorized data modification. Lack of permission verification allows authenticated attackers with Contributor-level access or higher to deactivate any active plugin on the site.

The Slider Revolution plugin for WordPress versions 7.0.0 – 7.0.14 exposes sensitive data via the 'slider.get.full' AJAX action. Authenticated attackers with Contributor-level access or higher can extract raw social media API credentials, including Instagram OAuth token, Flickr API key, YouTube Data API key, and Facebook App ID.

The Slider Revolution plugin for WordPress up to version 7.0.9 has a sensitive information exposure vulnerability via the 'get_stream_data()' function. Unauthenticated attackers can extract data including password-protected post, page, and product content.

The Slider Revolution plugin for WordPress in versions up to and including 6.7.37 is vulnerable to unauthorized access and modification due to missing capability checks on several functions. Authenticated attackers with Contributor-level access or higher can install and activate add-ons, create sliders, and download arbitrary files.

The Slider Revolution plugin for WordPress in versions up to and including 6.7.36 is vulnerable to path traversal via the 'used_svg' and 'used_images' parameters. An authenticated attacker with Contributor-level access or higher can read arbitrary files on the server, which may contain sensitive information.