Executive brief
Slider Pro is a WordPress plugin used to create responsive image and content sliders. A security vulnerability in versions 4.8.13 and earlier allows attackers to inject malicious scripts into the website. If a site visitor or administrator interacts with a specially crafted link or page, the attacker could potentially steal session information, redirect users to malicious sites, or deface the website.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the bqworks Slider Pro plugin for WordPress (versions <= 4.8.13) due to improper neutralization of input during web page generation (CWE-79). Although the vulnerability is associated with the 'Subscriber' role, the CVSS vector indicates that it can be triggered over the network with no prior authentication, provided there is user interaction (UI:R). An attacker can exploit this to inject malicious scripts into the site's frontend or backend. Successful exploitation requires a victim to visit a crafted page or click a malicious link, allowing the attacker to execute arbitrary JavaScript in the context of the victim's browser session. The issue is resolved in version 4.8.14.
Affected products
- bqworks Slider Pro <= 4.8.13
Timeline
- 2026-06-04: disclosed: Reported by manop55555
- 2026-07-20: advisory: Patchstack advisory published
- 2026-07-23: patched: Version 4.8.14 released to address the vulnerability