title: WP Contact Slider < 2.4.8 - Admin+ Stored Cross-Site Scripting
description: The WP Contact Slider WordPress plugin before 2.4.8 does not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
problem types: CWE-79 Cross-Site Scripting (XSS)
affected:
{
vendor: Unknown
product: WP Contact Slider
versions:
version: 2.4.8, status: affected, lessThan: 2.4.8, versionType: custom
}