Word Press Layer Slider Plugin SQL Injection Vulnerability (CVE-2024-2879) | Qualys

Summary: Qualys reported on March 25th, 2024 that CVE-2024-2879, an SQL injection vulnerability rated 7.5 out of 10.0 on the CVSS scale, affects LayerSlider plugin versions 7.9.11 through 7.10.0, which have more than 10 lakh active installations. The flaw stems from insufficient escaping in the ls_get_popup_markup action and improper validation in the find() function of the LS_Sliders class, letting unauthenticated attackers append SQL queries to extract sensitive database information.
Bottom line: More than 10 lakh active installations run this plugin, and an unauthenticated attacker can reach the database through a single unsanitized parameter - remediation requires upgrading to LayerSlider 7.10.1 or later.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-2879
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026