Skip to content
Noroxi

Master Slider – Responsive Touch Slider

master-slider · plugin

Known security vulnerabilities for Master Slider – Responsive Touch Slider. Find out in seconds which version runs on your site with WP Lens.

17 known vulnerabilities

1 critical · 5 exploitable without logging in · latest Jun 25, 2026

Listed on wordpress.org · latest 3.11.2 · last updated May 9, 2026 · 60K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2024-32600unauthenticated · needs a click≤ 3.9.5

    WordPress Master Slider plugin <= 3.9.5 - PHP Object Injection vulnerability

    Critical 9.6

  • CVE-2026-56014unauthenticated · needs a click≤ 3.11.2

    WordPress Master Slider plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-48968login required≤ 3.10.8

    WordPress Master Slider plugin <= 3.10.8 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2024-37222unauthenticated · needs a click≤ 3.10.0

    WordPress Master Slider plugin <= 3.10.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2025-58025login required≤ 3.11.0

    WordPress Master Slider Plugin <= 3.11.0 - Cross Site Scripting (XSS) Vulnerability

    Medium 5.4

  • CVE-2024-32580login required≤ 3.9.8

    WordPress Master Slider plugin <= 3.9.8 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2025-5291contributor+≤ 3.10.8

    Master Slider <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via masterslider_pb and ms_slide Shortcodes

    Medium 5.4

  • CVE-2024-13757contributor+≤ 3.10.6

    Master Slider – Responsive Touch Slider <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode

    Medium 5.4

  • CVE-2024-11731contributor+≤ 3.10.7

    Master Slider – Responsive Touch Slider <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_slider Shortcode

    Medium 5.4

  • CVE-2024-4375contributor+≤ 3.9.10

    Master Slider – Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode

    Medium 5.4

  • CVE-2023-6382contributor+≤ 3.9.9

    Master Slider - Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-4470contributor+≤ 3.9.9

    Master Slider – Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-1449contributor+≤ 3.9.10

    Master Slider – Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-0611editor+≤ 3.9.9

    Master Slider – Responsive Touch Slider <= 3.9.9 - Authenticated(Editor+) Stored Cross-Site Scripting via slider callback

    Medium 4.8

  • CVE-2023-50900unauthenticated · needs a click≤ 3.9.10

    WordPress Master Slider plugin <= 3.9.10 - Cross Site Request Forgery (CSRF) vulnerability

    Medium 4.3

  • CVE-2023-6326unauthenticated · needs a click≤ 3.9.10

    Master Slider - Responsive Touch Slider <= 3.9.10 - Cross-Site Request Forgery via process_bulk_action

    Medium 4.3

  • CVE-2025-39412login required≤ 3.11.0

    WordPress Master Slider plugin <= 3.11.0 - Broken Access Control vulnerability

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory