CVE-2022-2413

Slide Anything < 2.3.47 - Author+ Cross Site Scripting in slide title

The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript payload into the slide title even when the unfiltered_html capability is disabled.

We have discovered 13,087 live websites that are affected by CVE-2022-2413.

Test my site



Affected Software

Product  Slide Anything
Category Wordpress Plugins
Vulnerable Domains13,087 live websites (82.85% of Slide Anything install base)
Vulnerable Versions
  • from 0 before 2.3.47
Vulnerable Versions Count4 versions ( 66.67% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Jan 16, 2024
  • Updated - Aug 3, 2024

Credits

  • Nhật Nam (or LacHa) (finder)
  • WPScan (coordinator)

CVE-2022-2413 usage by Country

United States5,201 websites


Germany1,402 websites
France685 websites
GB603 websites
Russia478 websites
Poland446 websites
Netherlands316 websites
Australia259 websites
Italy249 websites
Cyprus230 websites

CVE-2022-2413 usage by TLD

.com5,658 websites
.de652 websites
.org600 websites
.co.uk481 websites
.ru386 websites
.com.au357 websites
.pl349 websites
.nl291 websites
.fr253 websites
.net250 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2022-2413

Top websites that are affected by CVE-2022-2413. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.org United States*,***
******************.de Germany**,***
**********.com GB**,***
**************.com United States**,***
***********.de Germany**,***
**************.org United States**,***
**************.ru Russia***,***
***********.com United States***,***
********.ca Canada***,***
***********.***.uk GB***,***
See full domain list

FAQ

CVE-2022-2413 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Slide Anything
A total of 13,087 websites have been identified as vulnerable to CVE-2022-2413, discovered through global website indexing conducted by WebTechSurvey.
Slide Anything is susceptible to CVE-2022-2413 vulnerability.
Slide Anything versions before 2.3.47 are vulnerable to CVE-2022-2413.
Version 2.3.47 of Slide Anything addresses the CVE-2022-2413 security vulnerability.