CVE-2021-24196: Cm-Wp Social Slider Widget

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized

Affected products

• Cm-Wp Social Slider Widget: before 1.8.5 (fixed in 1.8.5)

Published 2021-04-05. Last modified 2026-06-17.