The metaslider shortcode passed its attributes straight through without sanitising them. A contributor-level user who can add a shortcode to a post could inject arbitrary JavaScript that then executes in the browser of anyone viewing the page.
This vulnerability affects the following application versions:
- Slider, Gallery, and Carousel by MetaSlider 3.20.0
- Slider, Gallery, and Carousel by MetaSlider 3.20.1
- Slider, Gallery, and Carousel by MetaSlider 3.20.2
- Slider, Gallery, and Carousel by MetaSlider 3.20.3
- Slider, Gallery, and Carousel by MetaSlider 3.21.0
- Slider, Gallery, and Carousel by MetaSlider 3.22.0
- Slider, Gallery, and Carousel by MetaSlider 3.22.1
- Slider, Gallery, and Carousel by MetaSlider 3.23.0
- Slider, Gallery, and Carousel by MetaSlider 3.23.1
- Slider, Gallery, and Carousel by MetaSlider 3.23.2
- Slider, Gallery, and Carousel by MetaSlider 3.23.3
- Slider, Gallery, and Carousel by MetaSlider 3.23.4
- Slider, Gallery, and Carousel by MetaSlider 3.23.5
- Slider, Gallery, and Carousel by MetaSlider 3.24.0
- Slider, Gallery, and Carousel by MetaSlider 3.25.0
- Slider, Gallery, and Carousel by MetaSlider 3.25.1
- Slider, Gallery, and Carousel by MetaSlider 3.25.2
- Slider, Gallery, and Carousel by MetaSlider 3.26.0
- Slider, Gallery, and Carousel by MetaSlider 3.27.0
- Slider, Gallery, and Carousel by MetaSlider 3.27.1
- Slider, Gallery, and Carousel by MetaSlider 3.27.2
- Slider, Gallery, and Carousel by MetaSlider 3.27.3
- Slider, Gallery, and Carousel by MetaSlider 3.27.4
- Slider, Gallery, and Carousel by MetaSlider 3.27.5
- Slider, Gallery, and Carousel by MetaSlider 3.27.6
- Slider, Gallery, and Carousel by MetaSlider 3.27.7
- Slider, Gallery, and Carousel by MetaSlider 3.27.8
- Slider, Gallery, and Carousel by MetaSlider 3.27.10
- Slider, Gallery, and Carousel by MetaSlider 3.27.12
- Slider, Gallery, and Carousel by MetaSlider 3.27.14
- Slider, Gallery, and Carousel by MetaSlider 3.30.0
- Slider, Gallery, and Carousel by MetaSlider 3.30.1
- Slider, Gallery, and Carousel by MetaSlider 3.31.0
- Slider, Gallery, and Carousel by MetaSlider 3.32.0
- Slider, Gallery, and Carousel by MetaSlider 3.33.0
- Slider, Gallery, and Carousel by MetaSlider 3.34.0
- Slider, Gallery, and Carousel by MetaSlider 3.35.0
- Slider, Gallery, and Carousel by MetaSlider 3.36.0
- Slider, Gallery, and Carousel by MetaSlider 3.37.0
- Slider, Gallery, and Carousel by MetaSlider 3.40.0
- Slider, Gallery, and Carousel by MetaSlider 3.50.0
- Slider, Gallery, and Carousel by MetaSlider 3.60.0
- Slider, Gallery, and Carousel by MetaSlider 3.60.1
- Slider, Gallery, and Carousel by MetaSlider 3.61.0
- Slider, Gallery, and Carousel by MetaSlider 3.62.0
- Slider, Gallery, and Carousel by MetaSlider 3.70.0