Executive brief
Smart Slider 3 is a popular WordPress plugin used to create image sliders and carousels on websites. The plugin fails to properly sanitize user input in slider settings, allowing authenticated users with contributor access or higher to inject malicious scripts. When site editors or administrators view the affected content in WordPress's block editor, these scripts execute in their browser, potentially allowing attackers to steal credentials, modify page content, or perform administrative actions.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Smart Slider 3 plugin's Gutenberg block implementation, specifically in the handling of the 'slider' block attribute. The plugin fails to sanitize input when processing slider configuration via the block editor and does not properly escape output, allowing authenticated attackers with contributor-level or higher permissions to inject arbitrary JavaScript. The attack is persistent (stored in the database) and executes whenever a user opens the affected post in the WordPress block editor, targeting Editors and Administrators who are more likely to review such content. No user interaction beyond opening the post editor is required from the victim. Patches are expected to be available through plugin updates.
Affected products
- Nextend Smart Slider 3 up to and including 3.5.1.38
Timeline
- 2026-08-28: disclosed