CVE-2023-6382
📋 TL;DR
This vulnerability allows authenticated WordPress users with contributor-level permissions or higher to inject malicious JavaScript via the 'ms_slide' shortcode's 'css_class' attribute. The injected scripts execute whenever users view pages containing the compromised shortcode, affecting all WordPress sites using Master Slider plugin versions up to 3.9.9.
💻 Affected Systems
- Master Slider – Responsive Touch Slider WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, deface websites, or perform actions on behalf of authenticated users, potentially leading to complete site compromise.
Likely Case
Malicious contributors or compromised accounts inject tracking scripts, adware, or defacement content that affects all visitors to pages containing the vulnerable shortcode.
If Mitigated
With proper user access controls and input validation, impact is limited to authorized users who might still inject non-malicious but unwanted content.
🎯 Exploit Status
Exploitation requires contributor-level WordPress access. The vulnerability is well-documented with public proof-of-concept available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.9.9
Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3084860%40master-slider&new=3084860%40master-slider
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Master Slider plugin. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from WordPress plugin repository and manually update.
🔧 Temporary Workarounds
Remove Contributor Shortcode Permissions
allModify user roles to prevent contributors from using shortcodes
Use WordPress role editor plugin or custom code to remove 'unfiltered_html' capability from contributor role
Disable Master Slider Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate master-slider
🧯 If You Can't Patch
- Implement strict user access controls and monitor contributor activities
- Use web application firewall (WAF) rules to block suspicious shortcode usage
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Master Slider version. If version is 3.9.9 or lower, you are vulnerable.Check Version:
wp plugin get master-slider --field=versionVerify Fix Applied:
Verify Master Slider plugin version is higher than 3.9.9 in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual shortcode modifications in post/page edits
- Multiple 'ms_slide' shortcode updates from contributor accounts
Network Indicators:
- Unexpected JavaScript loading from WordPress pages containing slider content
SIEM Query:
source="wordpress" AND (event="post_updated" OR event="page_updated") AND user_role="contributor" AND content CONTAINS "ms_slide"🔗 References
- https://plugins.trac.wordpress.org/browser/master-slider/trunk/includes/msp-shortcodes.php#L55
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3065917%40master-slider&new=3065917%40master-slider&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3084860%40master-slider&new=3084860%40master-slider&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2d2fc926-6f9f-4ed9-9598-e39b5e6c6544?source=cve
- https://plugins.trac.wordpress.org/browser/master-slider/trunk/includes/msp-shortcodes.php#L55
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3065917%40master-slider&new=3065917%40master-slider&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3084860%40master-slider&new=3084860%40master-slider&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2d2fc926-6f9f-4ed9-9598-e39b5e6c6544?source=cve
