CVE-2024-13757: 
WordPress vulnerability analysis and mitigation

The Master Slider – Responsive Touch Slider WordPress plugin contains a Stored Cross-Site Scripting vulnerability (CVE-2024-13757) in versions up to and including 3.10.6. The vulnerability exists in the plugin's ms_layer shortcode due to insufficient input sanitization and output escaping on user-supplied attributes (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability requires an authenticated attacker with contributor-level access or higher privileges to exploit (Wordfence).

When successfully exploited, this vulnerability allows authenticated attackers to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to theft of sensitive information or manipulation of user sessions (NVD).

The vulnerability has been patched in version 3.10.7 of the Master Slider plugin. Users are advised to update to this latest version to protect against this security issue (WordPress Plugin).