Slider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.
Summary
The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be executed in the context of an administrator viewing the Slider Hero with Video Background, Animation WordPress plugin before 9.1.3's admin area, as well as any visitor of a page embedding a slider.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Slider Hero with Video Background, Animation | before 9.1.3 | 9.1.3 | Patch available | CNA |
- Slider Hero with Video Background, Animation VendorUnknown Affected before 9.1.3 Fixed in 9.1.3 Patch available CNA
Remediation
- Fix · CNA Slider Hero with Video Background, Animation (Unknown) Fixed in 9.1.3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-76789
- 2026-10-03 Alias added: GHSA-879w-x4vj-2mvp
References
Sources
- CVE-2026-76789 · CVE Program
- CVE-2026-76789 · NVD
- FIRST EPSS
- GHSA-879w-x4vj-2mvp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences