CVE-2023-6382: 
WordPress vulnerability analysis and mitigation

The Master Slider – Responsive Touch Slider WordPress plugin (versions up to and including 3.9.9) contains a Stored Cross-Site Scripting vulnerability (CVE-2023-6382) discovered in June 2024. The vulnerability exists in the plugin's 'ms_slide' shortcode due to insufficient input sanitization and output escaping on the user-supplied 'css_class' attribute (NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It received a CVSS v3.1 base score of 5.4 (Medium) from NIST with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Wordfence assigned a slightly higher score of 6.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page (NVD).

The vulnerability requires an authenticated user with at least contributor-level permissions to exploit. The attack vector is network-accessible with low attack complexity (NVD).

Users should update to version 3.9.10 or later of the Master Slider plugin, which contains the fix for this vulnerability (Patchstack).