Read the docs
TI-2026-15081 Aliases CVE-2026-18344GHSA-j3m7-4pfh-6m64

Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsive_thumbnail_image_management() function, which echoes $_GET['id'] directly into a double-quoted HTML attribute with no esc_attr() call. The only guard is a loose PHP numeric comparison ($_GET['id']>0) that a string beginning with a numeric prefix trivially satisfies, and the addslashes() applied by wp_magic_quotes() is inert in HTML-attribute context because backslash is not an HTML escape character. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00356 29th percentileScored 2026-11-07
Fix Fixed Responsive Thumbnail Slider (nik00726): 1.1.53

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nik00726Responsive Thumbnail Sliderbefore 1.1.531.1.53Patch availableCNA
  • Responsive Thumbnail Slider Vendornik00726 Affected before 1.1.53 Fixed in 1.1.53 Patch available CNA

Remediation

  • Fix · CNA Responsive Thumbnail Slider (nik00726) Fixed in 1.1.53

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-18344
  2. 2026-10-03 Alias added: GHSA-j3m7-4pfh-6m64

References

Other 3

  • TI-2023-06006 Email Subscription Popup < 1.2.20 - Reflected XSS CVSS 3.1MEDIUM 6.1
  • TI-2023-01799 Thumbnail carousel slider < 1.1.10 - Reflected XSS CVSS 3.1MEDIUM 6.1
  • TI-2015-08072 Responsive Thumbnail Slider < 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload CVSS 3.1HIGH 8.8
  • TI-2023-05356 Cross-site request forgery in nik00726 Thumbnail Slider With Lightbox CVSS 3.1CRITICAL 9.6
  • TI-2024-20221 WordPress WP Responsive Tabs horizontal vertical and accordion Tabs plugin <= 1.1.17 - SQL Injection vulnerability CVSS 3.1HIGH 8.8
  • TI-2025-09224 Responsive Filterable Portfolio <= 1.0.24 - Authenticated (Admin+) Arbitrary File Upload CVSS 3.1HIGH 7.2
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences