Description

The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-16T05:16:47.270Z",
  "pubdate": "2026-08-16T05:16:47.270Z",
  "executiveSummary": "The Serious Slider plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to, and including, 1.4.0. This security flaw stems from insufficient input sanitization and improper output escaping associated with the 'theme' shortcode attribute. The vulnerability allows authenticated malicious actors with contributor-level privileges or higher to inject arbitrary client-side scripts, such as JavaScript, directly into application pages. When unsuspecting users access an injected page, the malicious payload executes within the context of their browser session, leading to potential session hijacking, unauthorized actions performed on behalf of the victim, and overall compromise of the affected WordPress site integrity. Exploitation requires authenticated access with specific low-privileged roles, making it critical for administrators to secure contributor-level accounts and apply recommended remediations promptly.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Serious Slider plugin to properly sanitize user-supplied input and escape output data within the 'theme' shortcode attribute. Shortcodes in WordPress process parameters passed by users; when these parameters lack stringent validation, malicious strings can be persisted into the database.\nThe vulnerable component is the 'theme' shortcode attribute handler within the Serious Slider plugin. Affected versions include all iterations up to, and including, 1.4.0. The vulnerability requires authentication and contributor-level privileges or higher to inject the payload, which is then stored in the database, classifying the issue as a Stored Cross-Site Scripting (XSS) vulnerability.\nThe step-by-step attack flow proceeds as follows: First, an authenticated attacker possessing contributor-level privileges or higher creates or edits a WordPress post, page, or slider configuration that utilizes the Serious Slider shortcode. Second, the attacker injects a crafted payload containing arbitrary web scripts (such as malicious JavaScript) into the 'theme' shortcode attribute. Third, the plugin processes this attribute and writes the unescaped malicious data directly into the database without adequate sanitization. Fourth, when a victimized user or administrator navigates to the rendered page containing the injected shortcode, the server retrieves the stored payload from the database and outputs it directly into the HTML response without proper encoding. Finally, the victim's browser executes the injected script within the context of their active session.\nThe post-exploitation impact includes the execution of arbitrary scripts in the victim's browser, which can facilitate session token theft, redirection to malicious external resources, defacement of the affected pages, or the performance of unauthorized administrative actions if an administrator views the compromised page."
}