Description

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be executed in the context of an administrator viewing the Slider Hero with Video Background, Animation WordPress plugin before 9.1.3's admin area, as well as any visitor of a page embedding a slider.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-22T06:16:16.643Z",
  "pubdate": "2026-08-22T06:16:16.643Z",
  "executiveSummary": "The Slider Hero with Video Background, Animation WordPress plugin, in versions prior to 9.1.3, is affected by a Stored Cross-Site Scripting (XSS) vulnerability. This security defect stems from the absence of proper authorization checks, missing cryptographic nonces on two distinct request handlers, and a failure to adequately sanitize or escape a stored plugin setting before outputting it in the Document Object Model (DOM).\nThe vulnerability allows unauthenticated remote attackers to inject and persist malicious JavaScript payloads within the application state without requiring any prior authentication or privileged access. Successful exploitation of this flaw leads to the execution of arbitrary script code within the context of different user sessions, depending on where the payload is rendered.\nThe scope of impact encompasses both administrative users and front-end site visitors. When an administrator accesses the administrative interface of the Slider Hero with Video Background, Animation WordPress plugin, the injected JavaScript executes with elevated administrative privileges, potentially leading to full site compromise, privilege escalation, or unauthorized administrative actions. Furthermore, if the compromised slider is embedded on any public-facing page, site visitors will trigger the execution of the malicious script within their browsers, exposing them to session hijacking, client-side redirection, or credential theft.\nThis vulnerability represents a significant risk to confidentiality, integrity, and availability for WordPress installations utilizing vulnerable versions of the plugin. Mitigation requires updating the plugin to version 9.1.3 or higher once available, as well as monitoring and restricting unauthenticated request handling.",
  "technicalDetails": "The vulnerability is located within the request handling mechanisms of the Slider Hero with Video Background, Animation WordPress plugin, specifically affecting versions prior to 9.1.3. The root cause of the security issue is twofold: a complete lack of authorization controls and cryptographic nonce verification on two exposed request handlers, combined with improper output encoding of stored configuration settings.\nFrom an architectural standpoint, the application exposes endpoints intended for processing requests related to slider configurations. Because these request handlers omit nonce validation (anti-CSRF tokens) and do not verify whether the incoming request originates from an authenticated user with appropriate administrative capabilities, an unauthenticated attacker can directly interact with them over the network.\nThe attack vector relies on HTTP requests sent by unauthenticated actors to the vulnerable request handlers to modify plugin settings. The application accepts the supplied input and persists it directly into the database as a stored setting without enforcing sanitization protocols. When this malicious configuration value is subsequently retrieved and rendered into the application output without proper context-aware escaping, it results in Stored Cross-Site Scripting (XSS).\nThe attack flow unfolds through the following sequential phases: First, an unauthenticated attacker crafts an HTTP request containing malicious JavaScript payloads designed to manipulate the plugin settings. Second, the attacker transmits this payload to the vulnerable request handlers over the network. Third, the unauthenticated request is processed by the plugin without authorization checks or nonce verification, resulting in the persistence of the malicious JavaScript payload within the database storage.\nFourth, execution of the stored payload occurs in two distinct contexts depending on environmental triggers. In the administrative context, when an administrator navigates to the admin area of the Slider Hero with Video Background, Animation WordPress plugin, the raw JavaScript is rendered within the DOM and executed with administrative privileges. This enables the script to perform administrative-level actions via the browser. In the front-end context, if a slider embedding the payload is viewed by any site visitor on a published page, the malicious script executes within the visitor's browser session, impacting client security.\nThe affected versions include all instances of the Slider Hero with Video Background, Animation WordPress plugin prior to version 9.1.3. The network exposure is high, as the request handlers are accessible remotely over HTTP/HTTPS by unauthenticated users. Privilege requirements for triggering the storage of the payload are nonexistent, while the execution privileges scale up to administrative level when viewed by a privileged user or restricted visitor level when viewed on public pages."
}