Executive brief
The Slider Hero WordPress plugin is used to create animated sliders on websites. An attacker can inject malicious JavaScript code without authentication, which will execute when administrators access the plugin settings or when any website visitor views a page with an affected slider. This could allow attackers to steal administrator credentials, compromise the website, or redirect visitors to malicious sites.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Slider Hero plugin before version 9.1.3. The plugin fails to validate authorization and nonce tokens on two request handlers (hero_changeeffect and addslider tasks), and fails to escape a stored "effect" setting before outputting it in the admin area and on frontend shortcodes. An unauthenticated attacker can POST to the site with crafted parameters to inject JavaScript into slider settings, which then executes in the administrator's session context and in the browsers of all site visitors viewing affected sliders. The vulnerability requires no user interaction for the frontend attack vector (via shortcode output). Patches are available in version 9.1.3 and later.
Affected products
- WordPress Slider Hero with Video Background, Animation before 9.1.3
Timeline
- 2026-08-20: disclosed
- 2026-08-22: patched: Fixed in version 9.1.3