CVE-2023-2710 in Video Carousel Slider with Lightbox Plugin
Summary
by MITRE • 05/16/2023
The video carousel slider with lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-32797 may be a duplicate of this.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/09/2026
The vulnerability identified as CVE-2023-2710 affects the video carousel slider with lightbox plugin for WordPress, representing a critical security weakness that exposes users to reflected cross-site scripting attacks. This issue exists in plugin versions up to and including 1.0.22, where the software fails to properly sanitize user input or escape output before rendering it in web pages. The vulnerability specifically manifests through the search_term parameter, which serves as an entry point for malicious actors to inject harmful scripts into the plugin's functionality. The flaw stems from inadequate input validation mechanisms that allow attackers to bypass normal security controls and inject malicious code that can execute in the context of a victim's browser session.
The technical implementation of this vulnerability aligns with CWE-79, which defines cross-site scripting as a common weakness in web applications where untrusted data is improperly handled and executed within the browser. The reflected nature of this XSS vulnerability means that the malicious script is reflected off the web server and delivered to the victim's browser, typically through a crafted URL containing the malicious payload. Attackers can exploit this weakness by crafting specially formatted URLs with malicious scripts embedded in the search_term parameter, which when clicked by an unsuspecting user, executes the injected code within the user's browser context. This creates a persistent threat vector that can be leveraged for session hijacking, credential theft, or redirection to malicious sites.
The operational impact of this vulnerability extends beyond simple script execution, as it can be weaponized to perform more sophisticated attacks within the context of the affected WordPress site. Unauthenticated attackers can leverage this weakness to compromise user sessions, steal cookies, or redirect users to phishing sites without requiring any privileged access or authentication. The vulnerability's exploitation requires minimal technical skill, making it particularly dangerous as it can be automated and deployed at scale. The reflected nature of the attack means that the malicious code does not persist on the server but is executed in real-time when victims interact with specially crafted links, making detection and prevention more challenging for system administrators.
Mitigation strategies for this vulnerability should prioritize immediate plugin updates to versions that address the input sanitization and output escaping deficiencies. System administrators should also implement additional security measures including web application firewalls that can detect and block malicious payloads targeting known XSS patterns, input validation at the application level, and proper output encoding for all user-supplied data. The implementation of content security policies can provide additional protection layers by restricting the sources from which scripts can be executed within the browser context. Organizations should also conduct regular security assessments of their WordPress installations, including vulnerability scanning and penetration testing to identify similar weaknesses in other plugins or themes that may present comparable risks. The ATT&CK framework categorizes this type of vulnerability under T1213 - Data from Information Repositories, as it represents a method for attackers to extract or manipulate data through web application vulnerabilities.