Description

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected scripts execute specifically when a user opens the affected post in the WordPress block editor, making Editors and Administrators the primary targets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-28T05:16:41.367Z",
  "pubdate": "2026-08-28T05:16:41.367Z",
  "executiveSummary": "The Smart Slider 3 plugin for WordPress is vulnerable to a critical Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 3.5.1.38. This security flaw stems from a fundamental failure to adequately sanitize user input and escape output within the 'slider' block attribute component. This deficiency permits the persistent storage of malicious payloads, posing a continuous threat until manually remediated.\nConsequently, authenticated threat actors possessing contributor-level privileges or higher can successfully inject arbitrary JavaScript or HTML payloads into WordPress posts or pages. When administrative or editorial users subsequently access the compromised post within the WordPress block editor interface, the embedded malicious script executes automatically within the context of their active, authenticated browser session.\nThis vulnerability poses a severe threat to the overall integrity, availability, and confidentiality of the affected WordPress ecosystem, as it allows low-privilege users to directly target high-privilege accounts. Successful exploitation can lead to administrative session hijacking, unauthorized theme or plugin modifications, and potential full website compromise. It effectively bypasses standard security boundaries by leveraging trusted internal contributor roles to execute arbitrary administrative-level actions without requiring external user interaction.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input sanitization and output escaping of the 'slider' block attribute within the Smart Slider 3 plugin architecture. In the WordPress ecosystem, block attributes are utilized by the block editor (Gutenberg) to store configuration settings, parameters, and metadata for specific block components. When a contributor-level user adds, configures, or modifies a Smart Slider 3 block, the plugin processes the input submitted via the 'slider' attribute. Because the plugin fails to sanitize this input properly before storing it in the database, and subsequently fails to escape the output when rendering it within the administrative interface, arbitrary web scripts can be stored persistently within the system database.\nThe attack flow begins with an authenticated attacker who has contributor-level privileges or higher. Within the default WordPress permission model, contributors have the ability to create and edit posts but lack the permission to publish them. This limitation is bypassed in terms of impact because the attacker can insert a custom Smart Slider 3 block containing a malicious payload inside the 'slider' attribute of a draft post. The payload, typically consisting of obfuscated JavaScript code, is saved to the wp_posts database table as part of the post content metadata.\nOnce the payload is successfully stored, the attack relies on a user with higher privileges, specifically an Editor or an Administrator, opening the affected post in the WordPress block editor for review or modification. During the loading and rendering phase of the block editor, the application parses the post's blocks and dynamically renders the preview of the Smart Slider 3 block. Due to the lack of proper context-aware output escaping during this rendering process, the web browser interprets the injected attribute value as an executable script rather than benign text data.\nThe script then executes instantly within the victim's browser session with the full security context and permissions of the active Editor or Administrator. The post-exploitation impact of this execution is highly severe. The running script can perform administrative actions silently on behalf of the victim without their knowledge. This includes actions such as creating new administrator accounts, modifying existing plugin files to introduce persistent web shells, redirecting site traffic to malicious external landing pages, or exfiltrating sensitive database credentials and configuration information.\nFurthermore, because the execution is triggered exclusively during the editing phase within the administrative back-end rather than the public-facing front-end rendering phase, traditional front-end Web Application Firewalls (WAFs) may fail to inspect, detect, or block the malicious payload stored in the database. The malicious traffic occurs entirely within trusted administrative operations, significantly increasing the difficulty of detection and allowing the attacker to establish persistent unauthorized access."
}