Executive brief
The Wp Responsive Thumbnail Slider plugin for WordPress, which is used to create image galleries, contains a security flaw that allows for reflected cross-site scripting. An attacker can trick a user into clicking a malicious link, allowing the attacker to run unauthorized code in the user's browser. This could lead to the theft of sensitive information or unauthorized actions performed on behalf of the user.
Technical details
The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the responsive_thumbnail_image_management() function. Specifically, the plugin echoes the 'id' GET parameter directly into a double-quoted HTML attribute without using esc_attr(). While a loose PHP numeric comparison is present, it can be bypassed by strings starting with a numeric prefix. Furthermore, the default WordPress magic quotes are ineffective in this HTML-attribute context. An unauthenticated attacker can exploit this by convincing a user to click a specially crafted link, resulting in arbitrary script execution in the victim's browser session. The issue is fixed in version 1.1.53.
Affected products
- nik00726 Wp Responsive Thumbnail Slider up to, and excluding, 1.1.53
Timeline
- 2026-08-01: disclosed
- 2026-08-01: advisory
References
- https://plugins.trac.wordpress.org/browser/wp-responsive-thumbnail-slider/trunk/wp-responsive-images-thumbnail-slider.php
- https://plugins.trac.wordpress.org/browser/wp-responsive-thumbnail-slider/trunk/wp-responsive-images-thumbnail-slider.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c7370cbc-f681-49d7-9330-762443202529?source=cve