CVE-2023-6326

The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.10. This is due to missing or incorrect nonce validation on the 'process_bulk_action' function. This makes it possible for unauthenticated attackers to duplicate or delete arbitrary sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2023-50900 and CVE-2024-6490 may be a duplicate of this issue.

• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/browser/master-slider/trunk/admin/includes/classes/class-msp-list-table.phpProduct
• https://plugins.trac.wordpress.org/changeset/3138224/master-slider/trunk/admin/includes/classes/class-msp-list-table.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5e0a7108-15ef-42d0-adce-fd5b0e6faf3c?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/master-slider/trunk/admin/includes/classes/class-msp-list-table.phpProduct
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5e0a7108-15ef-42d0-adce-fd5b0e6faf3c?source=cveThird Party Advisory

Published

Mar 2, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-6320A command injection vulnerability exists in the com.webos.se…7.2
• CVE-2023-6321A command injection vulnerability exists in the IOCTL that m…8.8
• CVE-2023-6322A stack-based buffer overflow vulnerability exists in the me…8.8
• CVE-2023-6323ThroughTek Kalay SDK does not verify the authenticity of rec…6.5
• CVE-2023-6324ThroughTek Kalay SDK uses a predictable PSK value in the DTL…8.8
• CVE-2023-6325The RomethemeForm For Elementor plugin for WordPress is vuln…5.3
• CVE-2023-6327The ShopLentor (formerly WooLentor) plugin for WordPress is …5.3
• CVE-2023-6329An authentication bypass vulnerability exists in Control iD …9.8
• CVE-2023-6333 The affected ControlByWeb Relay products are vulnerable to …5.4
• CVE-2023-6334Improper Restriction of Operations within the Bounds of a Me…7.8
• CVE-2023-6335Improper Link Resolution Before File Access ('Link Following…7.8
• CVE-2023-6336Improper Link Resolution Before File Access ('Link Following…7.8