Description

The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the affected post is viewed. No fixed version is available. Until one ships, restrict the Contributor role to trusted users, or deactivate the Master Slider WordPress plugin through 3.11.2. Site owners who need to keep it active can block the ms_slider shortcode for roles below Editor, for example with a shortcode-restriction Master Slider WordPress plugin through 3.11.2, which prevents the attack without removing the Master Slider WordPress plugin through 3.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-20T07:16:48.533Z",
  "pubdate": "2026-09-20T07:16:48.533Z",
  "executiveSummary": "The Master Slider WordPress plugin, versions 3.11.2 and earlier, contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input sanitization and output escaping of shortcode attributes.\nThis vulnerability allows authenticated users with the Contributor role or higher to inject malicious JavaScript payloads into post content via the 'ms_slider' shortcode. When a victim views a post containing the compromised shortcode, the attacker's script executes within the context of the victim's browser session.\nThe primary impact involves unauthorized actions performed on behalf of the victim, such as credential theft via session hijacking, unauthorized administrative actions, or the redirection of users to malicious domains.\nAs there is no vendor-supplied patch available, the vulnerability represents a significant risk to the integrity and confidentiality of the WordPress installation. Successful exploitation requires an attacker to possess at least Contributor-level privileges, which is a standard feature of many multi-user WordPress environments.",
  "technicalDetails": "The vulnerability resides in the handling of user-supplied input within the 'ms_slider' shortcode of the Master Slider plugin. The application fails to perform adequate input validation or context-aware output encoding on various shortcode attributes before rendering them into the page HTML.\nSpecifically, the plugin processes these attributes and subsequently injects them directly into an inline script block on the client-side. Because the application does not properly escape these values, an attacker can break out of the intended JavaScript string or variable context by supplying characters such as quotes, backslashes, or brackets.\nThe exploitation flow begins when an authenticated user with Contributor privileges crafts a post containing a malicious payload embedded within a 'ms_slider' shortcode attribute. For example, by supplying a payload such as '\" ; alert(document.cookie); //', the attacker can terminate the intended JavaScript statement and execute arbitrary code.\nWhen a post or page containing this shortcode is rendered, the WordPress server outputs the malicious payload into the DOM. Because the browser interprets the inline script context as trusted code, it executes the injected JavaScript commands immediately upon page load.\nThe execution happens in the security context of the victim's session. If the victim is an administrator, the attacker can execute administrative functions, such as creating new user accounts, modifying plugin settings, or injecting further malicious content into the database, effectively achieving persistent, high-privileged access.\nThe lack of server-side sanitization at the point of input allows this data to be stored permanently in the database. Consequently, the XSS payload is served to every user who accesses the compromised post, leading to a widespread security breach that persists until the shortcode is manually sanitized or the plugin is removed.\nThe vulnerability affects all versions of the Master Slider plugin up to and including 3.11.2. The attack is internal to the application layer and does not require network-level access beyond having valid account credentials with appropriate permissions to post content."
}