CVE-2018-20368: The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.

medium Affects master-slider (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2018-12-23; advisory modified 2026-06-17.

The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.

Package: master-slider (WordPress plugin) WordPress
Affected versions: =3.2.7 or =3.5.1
Fixed in: no fix recorded
Severity: medium CVSS 5.4
Exploitation: not on CISA KEV · EPSS 1% (53.2th percentile)
Published: 2018-12-23
Source: nvd

References

CWE-79

NVD record master-slider (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2024-0611 medium The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored C same package: master-slider (WordPress plugin)
CVE-2024-1449 medium The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored C same package: master-slider (WordPress plugin)
CVE-2024-12173 low The Master Slider WordPress plugin before 3.10.5 does not sanitise and escape some of its same package: master-slider (WordPress plugin)
CVE-2024-4375 medium The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored C same package: master-slider (WordPress plugin)
CVE-2024-4470 medium The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored C same package: master-slider (WordPress plugin)
CVE-2023-6382 medium The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored C same package: master-slider (WordPress plugin)