Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-13116: Crelly Slider plugin lets admins inject malicious code

CVE-2024-13116 · published 1 year ago

Summary

The Crelly Slider add‑on for WordPress (versions before 1.4.7) fails to clean up certain settings. This means an administrator could store hidden scripts that run in other users' browsers, potentially stealing data or altering pages. Update the plugin to version 1.4.7 or later, or remove it if you cannot upgrade.

What to do

Update crelly_slider_project crelly_slider to version 1.4.7 or later.

Affected software

Vendor	Product	Affected versions
crelly_slider_project	crelly_slider	< 1.4.7 `cpe:2.3:a:crelly_slider_project:crelly_slider::::::wordpress::*`

Original advisory text

Crelly Slider < 1.4.7 - Admin+ Stored XSS

The Crelly Slider WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13116... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-13116 Vendor Advisory
https://wpscan.com/vulnerability/1755c8ad-7620-4b12-bba0-013e80c2691b/ Exploit

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.8 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published27 Jan 2025

Updated3 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-13116 · NVD

CVE-2024-13116 · OSV

Track software like this

Free during beta