Cross-site scripting in MetaSlider Slider, Gallery, and Carousel by MetaSlider – Image…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ml-slider custom post type is registered without custom capability restrictions and the ml-slider_settings meta key is unprotected, allowing Author-level users to set the malicious delay value via XML-RPC custom_fields when creating an ml-slider post.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MetaSlider | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider | up to 3.111.0 | — | No fix listed | CNA |
- Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider VendorMetaSlider Affected up to 3.111.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-18400
- 2026-10-03 Alias added: GHSA-mrw5-7p4v-67jq
References
Other 13
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3f0082c6-c040-4244-be7b-b133fd24d093?source=cve
- https://plugins.trac.wordpress.org/browser/ml-slider/tags/3.111.0/inc/slider/metaslider.class.php#L660
- https://plugins.trac.wordpress.org/browser/ml-slider/tags/3.111.0/inc/slider/metaslider.class.php#L54
- https://plugins.trac.wordpress.org/browser/ml-slider/tags/3.111.0/ml-slider.php#L449
- https://plugins.trac.wordpress.org/browser/ml-slider/tags/3.111.0/inc/slider/metaslider.flex.class.php#L346
- https://plugins.trac.wordpress.org/browser/ml-slider/tags/3.111.0/ml-slider.php#L604
- https://plugins.trac.wordpress.org/browser/ml-slider/tags/3.106.0/inc/slider/metaslider.class.php#L660
- https://plugins.trac.wordpress.org/browser/ml-slider/tags/3.106.0/inc/slider/metaslider.class.php#L54
- https://plugins.trac.wordpress.org/browser/ml-slider/tags/3.106.0/ml-slider.php#L449
- https://plugins.trac.wordpress.org/browser/ml-slider/tags/3.106.0/inc/slider/metaslider.flex.class.php#L346
- https://plugins.trac.wordpress.org/browser/ml-slider/tags/3.106.0/ml-slider.php#L604
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fml-slider/tags/3.111.0&new_path=%2Fml-slider/tags/3.111.1
- https://plugins.trac.wordpress.org/changeset/3633208/ml-slider/trunk/inc/slider/metaslider.class.php
More MetaSlider vulnerabilities
- TI-2023-01392 Responsive WordPress Slideshows 3.29.0 - Reflected XSS CVSS 3.1MEDIUM 6.1
- TI-2025-19679 Deserialization of untrusted data in MetaSlider Responsive Slider by MetaSlider CVSS 3.1CRITICAL 9.8
- TI-2025-01028 Slider, Gallery, Carousel by MetaSlider < 3.95.0 - Editor+ Stored XSS CVSS 3.1LOW 3.5
- TI-2025-00901 Slider, Gallery, Carousel by MetaSlider < 3.95.0 - Editor+ Stored XSS CVSS 3.1LOW 3.5
- TI-2026-28439 WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 9.1
- TI-2026-28441 WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - PHP Object Injection vulnerability CVSS 3.1HIGH 7.2
Sources
- CVE-2026-18400 · CVE Program
- CVE-2026-18400 · NVD
- FIRST EPSS
- GHSA-mrw5-7p4v-67jq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences