Master Slider vulnerabilities | LiveThreat CVE Feed

Product

Master Slider

by averta · last CVE Jun 25, 2026

CVEs

On KEV

9.6

Max CVSS

New 30D

Vulnerabilities21 In the news0 Timeline

Severity mix

Critical 1High 1Medium 18Low 1

Severity

All severities21 Critical1 High1 Medium18 Low1

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Master Slider to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-32600	9.6	0%	Apr 18	WordPress Master Slider plugin <= 3.9.5 - PHP Object Injection vulnerability Affected: through 3.9.5
CVE-2026-56014	7.1	0%	Jun 25	WordPress Master Slider plugin <= 3.11.5 - Cross Site Scripting (XSS) vulnerability Affected: through 3.11.5
CVE-2026-48968	6.5	0%	May 27	WordPress Master Slider plugin <= 3.10.8 - Cross Site Scripting (XSS) vulnerability Affected: through 3.10.8
CVE-2024-6490	6.5	0%	Jul 26	Master Slider – Responsive Touch Slider <= 3.9.10 - CSRF to slider deletion Affected: before 3.10.0
CVE-2024-37222	6.1	0%	Jun 20	WordPress Master Slider plugin <= 3.10.0 - Reflected Cross Site Scripting (XSS) vulnerability Affected: through 3.10.0
CVE-2023-47508	6.1	0%	Nov 16	WordPress Master Slider Pro Plugin <= 3.6.5 is vulnerable to Cross Site Scripting (XSS) Affected: through 3.6.5
CVE-2025-58025	5.4	0%	Sep 22	WordPress Master Slider Plugin <= 3.11.0 - Cross Site Scripting (XSS) Vulnerability Affected: through 3.11.0
CVE-2025-5291	5.4	0%	Jun 17	Master Slider <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via masterslider_pb and ms_slide Shortcodes Affected: before 3.10.9
CVE-2024-11731	5.4	0%	Mar 5	Master Slider – Responsive Touch Slider <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_slider Shortcode Affected: before 3.10.7
CVE-2024-13757	5.4	0%	Mar 5	Master Slider – Responsive Touch Slider <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode Affected: through 3.10.6
CVE-2024-4375	5.4	0%	Jun 18	Master Slider – Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode Affected: through 3.9.10
CVE-2023-6382	5.4	0%	Jun 1	Master Slider - Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: before 3.9.10
CVE-2024-4470	5.4	0%	May 21	Master Slider – Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: before 3.9.10
CVE-2024-32580	5.4	0%	Apr 18	WordPress Master Slider plugin <= 3.9.8 - Cross Site Scripting (XSS) vulnerability Affected: through 3.9.8
CVE-2024-1449	5.4	0%	Mar 2	Master Slider – Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: before 3.9.10
CVE-2018-20368	5.4	1%	Dec 23	The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback Affected: 3.2.7; 3.5.1
CVE-2024-0611	4.8	1%	Mar 2	Master Slider – Responsive Touch Slider <= 3.9.9 - Authenticated(Editor+) Stored Cross-Site Scripting via slider callback Affected: before 3.9.10
CVE-2025-39412	4.3	0%	May 19	WordPress Master Slider plugin <= 3.11.0 - Broken Access Control vulnerability Affected: through 3.11.0
CVE-2023-50900	4.3	0%	Jun 19	WordPress Master Slider plugin <= 3.9.10 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 3.9.10
CVE-2023-6326	4.3	0%	Mar 2	Master Slider - Responsive Touch Slider <= 3.9.10 - Cross-Site Request Forgery via process_bulk_action Affected: before 3.10.0
CVE-2024-12173	3.5	0%	Feb 19	Master Slider < 3.10.5 - Editor+ Stored XSS Affected: before 3.10.5