Vulnerability Details CVE-2015-3634
The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to read arbitrary Wordpress option values.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.035
EPSS Ranking 87.8%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
- http://www.openwall.com/lists/oss-security/2015/05/02/12
- http://www.securityfocus.com/bid/74453
- https://github.com/Boonstra/Slideshow/commit/cac505e593cbe70a4d8af5b639f5385d4cc7aa04
- https://wordpress.org/plugins/slideshow-jquery-image-gallery/#developers
- http://www.openwall.com/lists/oss-security/2015/05/02/12
- http://www.securityfocus.com/bid/74453
- https://github.com/Boonstra/Slideshow/commit/cac505e593cbe70a4d8af5b639f5385d4cc7aa04
- https://wordpress.org/plugins/slideshow-jquery-image-gallery/#developers
Products affected by CVE-2015-3634
-
cpe:2.3:a:slideshow_project:slideshow:2.2.10
-
cpe:2.3:a:slideshow_project:slideshow:2.2.11
-
cpe:2.3:a:slideshow_project:slideshow:2.2.12
-
cpe:2.3:a:slideshow_project:slideshow:2.2.13
-
cpe:2.3:a:slideshow_project:slideshow:2.2.14
-
cpe:2.3:a:slideshow_project:slideshow:2.2.15
-
cpe:2.3:a:slideshow_project:slideshow:2.2.16
-
cpe:2.3:a:slideshow_project:slideshow:2.2.17
-
cpe:2.3:a:slideshow_project:slideshow:2.2.18
-
cpe:2.3:a:slideshow_project:slideshow:2.2.19
-
cpe:2.3:a:slideshow_project:slideshow:2.2.20
-
cpe:2.3:a:slideshow_project:slideshow:2.2.21
-
cpe:2.3:a:slideshow_project:slideshow:2.2.8
-
cpe:2.3:a:slideshow_project:slideshow:2.2.9