CVE-2023-5821 - CVE House
Back to Database
Status published Medium CVE-2023-5821

The Thumbnail carousel slider plugin for WordPress is vulnerable to...

Vulnerability Description

The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the deleteselected function. This makes it possible for unauthenticated attackers to delete sliders in bulk via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-5821

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Ala Arfaoui

References

More from nik00726

View All →
CVE-2025-10049
Responsive Filterable Portfolio <= 1.0.24 - Authenticated (Admin+) Arbitrary File Upload
High 7.2
CVE-2024-12237
Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.15 - Authenticated (Subscriber+) Limited Server-Side Request Forgery
Medium 4.3
CVE-2024-11195
Email Subscription Popup <= 1.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via print_email_subscribe_form Shortcode
Medium 6.4
CVE-2023-7295
Video Grid <= 1.21 - Reflected Cross-Site Scripting
Medium 6.1
CVE-2023-6527
Email Subscription Popup <= 1.2.18 - Reflected Cross-Site Scripting
Medium 6.1

Affected Vendor

Affected Software

Thumbnail carousel slider
Vulnerable Versions:
1.0

Timeline

Official Publish: October 27th, 2023
Last Modified: February 5th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.