Slider, Gallery, and Carousel by MetaSlider

MetaSlider up to 3.94.0 passes meta values from an imported slideshow file to unserialize() without restricting classes. A crafted import file can inject arbitrary PHP objects, which can lead to remote code execution, file deletion or data theft when a suitable POP chain is present on the site.

This vulnerability affects the following application versions:

• Slider, Gallery, and Carousel by MetaSlider 3.18.0
• Slider, Gallery, and Carousel by MetaSlider 3.18.1
• Slider, Gallery, and Carousel by MetaSlider 3.18.2
• Slider, Gallery, and Carousel by MetaSlider 3.18.3
• Slider, Gallery, and Carousel by MetaSlider 3.18.4
• Slider, Gallery, and Carousel by MetaSlider 3.18.5
• Slider, Gallery, and Carousel by MetaSlider 3.18.6
• Slider, Gallery, and Carousel by MetaSlider 3.18.7
• Slider, Gallery, and Carousel by MetaSlider 3.18.8
• Slider, Gallery, and Carousel by MetaSlider 3.18.9
• Slider, Gallery, and Carousel by MetaSlider 3.19.0
• Slider, Gallery, and Carousel by MetaSlider 3.19.1
• Slider, Gallery, and Carousel by MetaSlider 3.20.0
• Slider, Gallery, and Carousel by MetaSlider 3.20.1
• Slider, Gallery, and Carousel by MetaSlider 3.20.2
• Slider, Gallery, and Carousel by MetaSlider 3.20.3
• Slider, Gallery, and Carousel by MetaSlider 3.21.0
• Slider, Gallery, and Carousel by MetaSlider 3.22.0
• Slider, Gallery, and Carousel by MetaSlider 3.22.1
• Slider, Gallery, and Carousel by MetaSlider 3.23.0
• Slider, Gallery, and Carousel by MetaSlider 3.23.1
• Slider, Gallery, and Carousel by MetaSlider 3.23.2
• Slider, Gallery, and Carousel by MetaSlider 3.23.3
• Slider, Gallery, and Carousel by MetaSlider 3.23.4
• Slider, Gallery, and Carousel by MetaSlider 3.23.5
• Slider, Gallery, and Carousel by MetaSlider 3.24.0
• Slider, Gallery, and Carousel by MetaSlider 3.25.0
• Slider, Gallery, and Carousel by MetaSlider 3.25.1
• Slider, Gallery, and Carousel by MetaSlider 3.25.2
• Slider, Gallery, and Carousel by MetaSlider 3.26.0
• Slider, Gallery, and Carousel by MetaSlider 3.27.0
• Slider, Gallery, and Carousel by MetaSlider 3.27.1
• Slider, Gallery, and Carousel by MetaSlider 3.27.2
• Slider, Gallery, and Carousel by MetaSlider 3.27.3
• Slider, Gallery, and Carousel by MetaSlider 3.27.4
• Slider, Gallery, and Carousel by MetaSlider 3.27.5
• Slider, Gallery, and Carousel by MetaSlider 3.27.6
• Slider, Gallery, and Carousel by MetaSlider 3.27.7
• Slider, Gallery, and Carousel by MetaSlider 3.27.8
• Slider, Gallery, and Carousel by MetaSlider 3.27.9
• Slider, Gallery, and Carousel by MetaSlider 3.27.9-beta.2
• Slider, Gallery, and Carousel by MetaSlider 3.27.9-beta.3
• Slider, Gallery, and Carousel by MetaSlider 3.27.10
• Slider, Gallery, and Carousel by MetaSlider 3.27.11
• Slider, Gallery, and Carousel by MetaSlider 3.27.12
• Slider, Gallery, and Carousel by MetaSlider 3.27.13
• Slider, Gallery, and Carousel by MetaSlider 3.27.14
• Slider, Gallery, and Carousel by MetaSlider 3.28.0
• Slider, Gallery, and Carousel by MetaSlider 3.28.1
• Slider, Gallery, and Carousel by MetaSlider 3.28.2
• Slider, Gallery, and Carousel by MetaSlider 3.28.3
• Slider, Gallery, and Carousel by MetaSlider 3.29.0
• Slider, Gallery, and Carousel by MetaSlider 3.29.1
• Slider, Gallery, and Carousel by MetaSlider 3.30.0
• Slider, Gallery, and Carousel by MetaSlider 3.30.1
• Slider, Gallery, and Carousel by MetaSlider 3.31.0
• Slider, Gallery, and Carousel by MetaSlider 3.32.0
• Slider, Gallery, and Carousel by MetaSlider 3.33.0
• Slider, Gallery, and Carousel by MetaSlider 3.34.0
• Slider, Gallery, and Carousel by MetaSlider 3.35.0
• Slider, Gallery, and Carousel by MetaSlider 3.36.0
• Slider, Gallery, and Carousel by MetaSlider 3.37.0
• Slider, Gallery, and Carousel by MetaSlider 3.40.0
• Slider, Gallery, and Carousel by MetaSlider 3.50.0
• Slider, Gallery, and Carousel by MetaSlider 3.60.0
• Slider, Gallery, and Carousel by MetaSlider 3.60.1
• Slider, Gallery, and Carousel by MetaSlider 3.61.0
• Slider, Gallery, and Carousel by MetaSlider 3.62.0
• Slider, Gallery, and Carousel by MetaSlider 3.70.0
• Slider, Gallery, and Carousel by MetaSlider 3.70.1
• Slider, Gallery, and Carousel by MetaSlider 3.70.2
• Slider, Gallery, and Carousel by MetaSlider 3.80.0
• Slider, Gallery, and Carousel by MetaSlider 3.90.0
• Slider, Gallery, and Carousel by MetaSlider 3.90.1
• Slider, Gallery, and Carousel by MetaSlider 3.91.0
• Slider, Gallery, and Carousel by MetaSlider 3.92.0
• Slider, Gallery, and Carousel by MetaSlider 3.92.1
• Slider, Gallery, and Carousel by MetaSlider 3.93.0
• Slider, Gallery, and Carousel by MetaSlider 3.94.0

MetaSlider 3.95.0 to 3.106.0 still passes the imported slideshow settings to WordPress core maybe_unserialize() without restricting classes, so an object nested inside a serialized array bypasses the import check. An Editor who can import slideshows can inject PHP objects with a crafted import file, which can lead to code execution when a suitable POP chain is present on the site.

This vulnerability affects the following application versions:

• Slider, Gallery, and Carousel by MetaSlider 3.95.0
• Slider, Gallery, and Carousel by MetaSlider 3.96.0
• Slider, Gallery, and Carousel by MetaSlider 3.97.0
• Slider, Gallery, and Carousel by MetaSlider 3.98.0
• Slider, Gallery, and Carousel by MetaSlider 3.99.0
• Slider, Gallery, and Carousel by MetaSlider 3.100.0
• Slider, Gallery, and Carousel by MetaSlider 3.100.1
• Slider, Gallery, and Carousel by MetaSlider 3.101.0
• Slider, Gallery, and Carousel by MetaSlider 3.102.0
• Slider, Gallery, and Carousel by MetaSlider 3.103.0
• Slider, Gallery, and Carousel by MetaSlider 3.104.0
• Slider, Gallery, and Carousel by MetaSlider 3.105.0
• Slider, Gallery, and Carousel by MetaSlider 3.106.0

MetaSlider up to 3.106.0 builds a PHP include path from the theme folder and version stored in a slideshow’s settings without sanitizing them, and checks imported theme images only by MIME type. A user with Editor access can plant a payload file and point a slideshow’s theme at it through path traversal, leading to remote code execution.

This vulnerability affects the following application versions:

• Slider, Gallery, and Carousel by MetaSlider 3.17.0
• Slider, Gallery, and Carousel by MetaSlider 3.17.1
• Slider, Gallery, and Carousel by MetaSlider 3.17.2
• Slider, Gallery, and Carousel by MetaSlider 3.17.3
• Slider, Gallery, and Carousel by MetaSlider 3.17.4
• Slider, Gallery, and Carousel by MetaSlider 3.17.5
• Slider, Gallery, and Carousel by MetaSlider 3.17.6
• Slider, Gallery, and Carousel by MetaSlider 3.18.0
• Slider, Gallery, and Carousel by MetaSlider 3.18.1
• Slider, Gallery, and Carousel by MetaSlider 3.18.2
• Slider, Gallery, and Carousel by MetaSlider 3.18.3
• Slider, Gallery, and Carousel by MetaSlider 3.18.4
• Slider, Gallery, and Carousel by MetaSlider 3.18.5
• Slider, Gallery, and Carousel by MetaSlider 3.18.6
• Slider, Gallery, and Carousel by MetaSlider 3.18.7
• Slider, Gallery, and Carousel by MetaSlider 3.18.8
• Slider, Gallery, and Carousel by MetaSlider 3.18.9
• Slider, Gallery, and Carousel by MetaSlider 3.19.0
• Slider, Gallery, and Carousel by MetaSlider 3.19.1
• Slider, Gallery, and Carousel by MetaSlider 3.20.0
• Slider, Gallery, and Carousel by MetaSlider 3.20.1
• Slider, Gallery, and Carousel by MetaSlider 3.20.2
• Slider, Gallery, and Carousel by MetaSlider 3.20.3
• Slider, Gallery, and Carousel by MetaSlider 3.21.0
• Slider, Gallery, and Carousel by MetaSlider 3.22.0
• Slider, Gallery, and Carousel by MetaSlider 3.22.1
• Slider, Gallery, and Carousel by MetaSlider 3.23.0
• Slider, Gallery, and Carousel by MetaSlider 3.23.1
• Slider, Gallery, and Carousel by MetaSlider 3.23.2
• Slider, Gallery, and Carousel by MetaSlider 3.23.3
• Slider, Gallery, and Carousel by MetaSlider 3.23.4
• Slider, Gallery, and Carousel by MetaSlider 3.23.5
• Slider, Gallery, and Carousel by MetaSlider 3.24.0
• Slider, Gallery, and Carousel by MetaSlider 3.25.0
• Slider, Gallery, and Carousel by MetaSlider 3.25.1
• Slider, Gallery, and Carousel by MetaSlider 3.25.2
• Slider, Gallery, and Carousel by MetaSlider 3.26.0
• Slider, Gallery, and Carousel by MetaSlider 3.27.0
• Slider, Gallery, and Carousel by MetaSlider 3.27.1
• Slider, Gallery, and Carousel by MetaSlider 3.27.2
• Slider, Gallery, and Carousel by MetaSlider 3.27.3
• Slider, Gallery, and Carousel by MetaSlider 3.27.4
• Slider, Gallery, and Carousel by MetaSlider 3.27.5
• Slider, Gallery, and Carousel by MetaSlider 3.27.6
• Slider, Gallery, and Carousel by MetaSlider 3.27.7
• Slider, Gallery, and Carousel by MetaSlider 3.27.8
• Slider, Gallery, and Carousel by MetaSlider 3.27.9
• Slider, Gallery, and Carousel by MetaSlider 3.27.9-beta.2
• Slider, Gallery, and Carousel by MetaSlider 3.27.9-beta.3
• Slider, Gallery, and Carousel by MetaSlider 3.27.10
• Slider, Gallery, and Carousel by MetaSlider 3.27.11
• Slider, Gallery, and Carousel by MetaSlider 3.27.12
• Slider, Gallery, and Carousel by MetaSlider 3.27.13
• Slider, Gallery, and Carousel by MetaSlider 3.27.14
• Slider, Gallery, and Carousel by MetaSlider 3.28.0
• Slider, Gallery, and Carousel by MetaSlider 3.28.1
• Slider, Gallery, and Carousel by MetaSlider 3.28.2
• Slider, Gallery, and Carousel by MetaSlider 3.28.3
• Slider, Gallery, and Carousel by MetaSlider 3.29.0
• Slider, Gallery, and Carousel by MetaSlider 3.29.1
• Slider, Gallery, and Carousel by MetaSlider 3.30.0
• Slider, Gallery, and Carousel by MetaSlider 3.30.1
• Slider, Gallery, and Carousel by MetaSlider 3.31.0
• Slider, Gallery, and Carousel by MetaSlider 3.32.0
• Slider, Gallery, and Carousel by MetaSlider 3.33.0
• Slider, Gallery, and Carousel by MetaSlider 3.34.0
• Slider, Gallery, and Carousel by MetaSlider 3.35.0
• Slider, Gallery, and Carousel by MetaSlider 3.36.0
• Slider, Gallery, and Carousel by MetaSlider 3.37.0
• Slider, Gallery, and Carousel by MetaSlider 3.40.0
• Slider, Gallery, and Carousel by MetaSlider 3.50.0
• Slider, Gallery, and Carousel by MetaSlider 3.60.0
• Slider, Gallery, and Carousel by MetaSlider 3.60.1
• Slider, Gallery, and Carousel by MetaSlider 3.61.0
• Slider, Gallery, and Carousel by MetaSlider 3.62.0
• Slider, Gallery, and Carousel by MetaSlider 3.70.0
• Slider, Gallery, and Carousel by MetaSlider 3.70.1
• Slider, Gallery, and Carousel by MetaSlider 3.70.2
• Slider, Gallery, and Carousel by MetaSlider 3.80.0
• Slider, Gallery, and Carousel by MetaSlider 3.90.0
• Slider, Gallery, and Carousel by MetaSlider 3.90.1
• Slider, Gallery, and Carousel by MetaSlider 3.91.0
• Slider, Gallery, and Carousel by MetaSlider 3.92.0
• Slider, Gallery, and Carousel by MetaSlider 3.92.1
• Slider, Gallery, and Carousel by MetaSlider 3.93.0
• Slider, Gallery, and Carousel by MetaSlider 3.94.0
• Slider, Gallery, and Carousel by MetaSlider 3.95.0
• Slider, Gallery, and Carousel by MetaSlider 3.96.0
• Slider, Gallery, and Carousel by MetaSlider 3.97.0
• Slider, Gallery, and Carousel by MetaSlider 3.98.0
• Slider, Gallery, and Carousel by MetaSlider 3.99.0
• Slider, Gallery, and Carousel by MetaSlider 3.100.0
• Slider, Gallery, and Carousel by MetaSlider 3.100.1
• Slider, Gallery, and Carousel by MetaSlider 3.101.0
• Slider, Gallery, and Carousel by MetaSlider 3.102.0
• Slider, Gallery, and Carousel by MetaSlider 3.103.0
• Slider, Gallery, and Carousel by MetaSlider 3.104.0
• Slider, Gallery, and Carousel by MetaSlider 3.105.0
• Slider, Gallery, and Carousel by MetaSlider 3.106.0

The slideshow title was stored without sanitisation and later printed into the page without escaping. A user allowed to edit slideshows, such as an editor, could place JavaScript in the title and have it run in the browser of anyone who views the slideshow, even where unfiltered_html is not granted.

This vulnerability affects the following application versions:

• Slider, Gallery, and Carousel by MetaSlider 3.20.0
• Slider, Gallery, and Carousel by MetaSlider 3.20.1
• Slider, Gallery, and Carousel by MetaSlider 3.20.2
• Slider, Gallery, and Carousel by MetaSlider 3.20.3
• Slider, Gallery, and Carousel by MetaSlider 3.21.0
• Slider, Gallery, and Carousel by MetaSlider 3.22.0
• Slider, Gallery, and Carousel by MetaSlider 3.22.1
• Slider, Gallery, and Carousel by MetaSlider 3.23.0
• Slider, Gallery, and Carousel by MetaSlider 3.23.1
• Slider, Gallery, and Carousel by MetaSlider 3.23.2
• Slider, Gallery, and Carousel by MetaSlider 3.23.3
• Slider, Gallery, and Carousel by MetaSlider 3.23.4
• Slider, Gallery, and Carousel by MetaSlider 3.23.5
• Slider, Gallery, and Carousel by MetaSlider 3.24.0
• Slider, Gallery, and Carousel by MetaSlider 3.25.0
• Slider, Gallery, and Carousel by MetaSlider 3.25.1
• Slider, Gallery, and Carousel by MetaSlider 3.25.2
• Slider, Gallery, and Carousel by MetaSlider 3.26.0
• Slider, Gallery, and Carousel by MetaSlider 3.27.0
• Slider, Gallery, and Carousel by MetaSlider 3.27.1
• Slider, Gallery, and Carousel by MetaSlider 3.27.2
• Slider, Gallery, and Carousel by MetaSlider 3.27.3
• Slider, Gallery, and Carousel by MetaSlider 3.27.4
• Slider, Gallery, and Carousel by MetaSlider 3.27.5
• Slider, Gallery, and Carousel by MetaSlider 3.27.6
• Slider, Gallery, and Carousel by MetaSlider 3.27.7
• Slider, Gallery, and Carousel by MetaSlider 3.27.8
• Slider, Gallery, and Carousel by MetaSlider 3.27.9
• Slider, Gallery, and Carousel by MetaSlider 3.27.9-beta.2
• Slider, Gallery, and Carousel by MetaSlider 3.27.9-beta.3
• Slider, Gallery, and Carousel by MetaSlider 3.27.10
• Slider, Gallery, and Carousel by MetaSlider 3.27.12
• Slider, Gallery, and Carousel by MetaSlider 3.27.13
• Slider, Gallery, and Carousel by MetaSlider 3.27.14
• Slider, Gallery, and Carousel by MetaSlider 3.28.0
• Slider, Gallery, and Carousel by MetaSlider 3.30.0
• Slider, Gallery, and Carousel by MetaSlider 3.30.1
• Slider, Gallery, and Carousel by MetaSlider 3.31.0
• Slider, Gallery, and Carousel by MetaSlider 3.32.0
• Slider, Gallery, and Carousel by MetaSlider 3.33.0
• Slider, Gallery, and Carousel by MetaSlider 3.34.0
• Slider, Gallery, and Carousel by MetaSlider 3.35.0
• Slider, Gallery, and Carousel by MetaSlider 3.36.0
• Slider, Gallery, and Carousel by MetaSlider 3.37.0
• Slider, Gallery, and Carousel by MetaSlider 3.40.0
• Slider, Gallery, and Carousel by MetaSlider 3.50.0
• Slider, Gallery, and Carousel by MetaSlider 3.60.0
• Slider, Gallery, and Carousel by MetaSlider 3.60.1
• Slider, Gallery, and Carousel by MetaSlider 3.61.0
• Slider, Gallery, and Carousel by MetaSlider 3.62.0
• Slider, Gallery, and Carousel by MetaSlider 3.70.0
• Slider, Gallery, and Carousel by MetaSlider 3.70.1
• Slider, Gallery, and Carousel by MetaSlider 3.70.2
• Slider, Gallery, and Carousel by MetaSlider 3.80.0
• Slider, Gallery, and Carousel by MetaSlider 3.90.0
• Slider, Gallery, and Carousel by MetaSlider 3.90.1
• Slider, Gallery, and Carousel by MetaSlider 3.91.0
• Slider, Gallery, and Carousel by MetaSlider 3.92.0
• Slider, Gallery, and Carousel by MetaSlider 3.92.1
• Slider, Gallery, and Carousel by MetaSlider 3.93.0
• Slider, Gallery, and Carousel by MetaSlider 3.94.0

The metaslider shortcode passed its attributes straight through without sanitising them. A contributor-level user who can add a shortcode to a post could inject arbitrary JavaScript that then executes in the browser of anyone viewing the page.

This vulnerability affects the following application versions:

• Slider, Gallery, and Carousel by MetaSlider 3.20.0
• Slider, Gallery, and Carousel by MetaSlider 3.20.1
• Slider, Gallery, and Carousel by MetaSlider 3.20.2
• Slider, Gallery, and Carousel by MetaSlider 3.20.3
• Slider, Gallery, and Carousel by MetaSlider 3.21.0
• Slider, Gallery, and Carousel by MetaSlider 3.22.0
• Slider, Gallery, and Carousel by MetaSlider 3.22.1
• Slider, Gallery, and Carousel by MetaSlider 3.23.0
• Slider, Gallery, and Carousel by MetaSlider 3.23.1
• Slider, Gallery, and Carousel by MetaSlider 3.23.2
• Slider, Gallery, and Carousel by MetaSlider 3.23.3
• Slider, Gallery, and Carousel by MetaSlider 3.23.4
• Slider, Gallery, and Carousel by MetaSlider 3.23.5
• Slider, Gallery, and Carousel by MetaSlider 3.24.0
• Slider, Gallery, and Carousel by MetaSlider 3.25.0
• Slider, Gallery, and Carousel by MetaSlider 3.25.1
• Slider, Gallery, and Carousel by MetaSlider 3.25.2
• Slider, Gallery, and Carousel by MetaSlider 3.26.0
• Slider, Gallery, and Carousel by MetaSlider 3.27.0
• Slider, Gallery, and Carousel by MetaSlider 3.27.1
• Slider, Gallery, and Carousel by MetaSlider 3.27.2
• Slider, Gallery, and Carousel by MetaSlider 3.27.3
• Slider, Gallery, and Carousel by MetaSlider 3.27.4
• Slider, Gallery, and Carousel by MetaSlider 3.27.5
• Slider, Gallery, and Carousel by MetaSlider 3.27.6
• Slider, Gallery, and Carousel by MetaSlider 3.27.7
• Slider, Gallery, and Carousel by MetaSlider 3.27.8
• Slider, Gallery, and Carousel by MetaSlider 3.27.10
• Slider, Gallery, and Carousel by MetaSlider 3.27.12
• Slider, Gallery, and Carousel by MetaSlider 3.27.14
• Slider, Gallery, and Carousel by MetaSlider 3.30.0
• Slider, Gallery, and Carousel by MetaSlider 3.30.1
• Slider, Gallery, and Carousel by MetaSlider 3.31.0
• Slider, Gallery, and Carousel by MetaSlider 3.32.0
• Slider, Gallery, and Carousel by MetaSlider 3.33.0
• Slider, Gallery, and Carousel by MetaSlider 3.34.0
• Slider, Gallery, and Carousel by MetaSlider 3.35.0
• Slider, Gallery, and Carousel by MetaSlider 3.36.0
• Slider, Gallery, and Carousel by MetaSlider 3.37.0
• Slider, Gallery, and Carousel by MetaSlider 3.40.0
• Slider, Gallery, and Carousel by MetaSlider 3.50.0
• Slider, Gallery, and Carousel by MetaSlider 3.60.0
• Slider, Gallery, and Carousel by MetaSlider 3.60.1
• Slider, Gallery, and Carousel by MetaSlider 3.61.0
• Slider, Gallery, and Carousel by MetaSlider 3.62.0
• Slider, Gallery, and Carousel by MetaSlider 3.70.0