CVE-2023-5820 - CVE House
Back to Database
Status published Critical CVE-2023-5820

The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable...

Vulnerability Description

The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the addedit functionality. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-5820

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Ala Arfaoui

References

More from nik00726

View All →
CVE-2025-10049
Responsive Filterable Portfolio <= 1.0.24 - Authenticated (Admin+) Arbitrary File Upload
High 7.2
CVE-2024-12237
Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.15 - Authenticated (Subscriber+) Limited Server-Side Request Forgery
Medium 4.3
CVE-2024-11195
Email Subscription Popup <= 1.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via print_email_subscribe_form Shortcode
Medium 6.4
CVE-2023-7295
Video Grid <= 1.21 - Reflected Cross-Site Scripting
Medium 6.1
CVE-2023-6527
Email Subscription Popup <= 1.2.18 - Reflected Cross-Site Scripting
Medium 6.1

Affected Vendor

Affected Software

Thumbnail Slider With Lightbox
Vulnerable Versions:
1.0

Timeline

Official Publish: October 27th, 2023
Last Modified: February 5th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.