CVE-2026-18344 in Responsive Thumbnail Slider Plugin
Summary
by MITRE • 08/01/2026
The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsive_thumbnail_image_management() function, which echoes $_GET['id'] directly into a double-quoted HTML attribute with no esc_attr() call. The only guard is a loose PHP numeric comparison ($_GET['id']>0) that a string beginning with a numeric prefix trivially satisfies, and the addslashes() applied by wp_magic_quotes() is inert in HTML-attribute context because backslash is not an HTML escape character. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability exists within the Wp Responsive Thumbnail Slider plugin for WordPress, specifically in version ranges up to but not including 1.1.53, representing a critical reflected cross-site scripting weakness that compromises user security. This flaw resides in the responsive_thumbnail_image_management() function where the plugin fails to properly sanitize user input before incorporating it into HTML output. The vulnerability stems from a fundamental lack of proper input validation and output escaping mechanisms, allowing malicious actors to inject arbitrary JavaScript code through the 'id' parameter.
The technical implementation of this vulnerability demonstrates a classic case of insufficient sanitization where the plugin directly echoes $_GET['id'] without any proper escaping or validation procedures. The function accepts user-supplied data and incorporates it into HTML attributes without applying esc_attr() filtering, creating an opening for attackers to execute malicious scripts within the context of a victim's browser session. This particular weakness is exacerbated by the presence of only a loose PHP numeric comparison check that merely verifies $_GET['id']>0, which proves inadequate as strings beginning with numeric prefixes can easily satisfy this condition without proper validation.
The security implications extend beyond simple data manipulation since the vulnerability operates through reflected XSS mechanisms that require minimal user interaction to exploit. Attackers can craft malicious URLs containing specially formatted payloads that appear legitimate when embedded in links, tricking users into inadvertently executing malicious scripts within their browser environment. The addslashes() function provided by wp_magic_quotes() offers no meaningful protection in this HTML attribute context because backslashes do not serve as HTML escape characters, rendering this defensive measure ineffective against the specific attack vector.
This vulnerability aligns with CWE-79, which specifically addresses cross-site scripting flaws in software applications, and demonstrates characteristics consistent with ATT&CK technique T1566.001 involving spearphishing through social engineering. The reflected nature of this XSS means that malicious payloads are not stored on the server but rather injected into web pages dynamically based on user input parameters. Users who are authenticated or simply visit compromised pages containing these malicious links face potential exposure to session hijacking, credential theft, or redirection to malicious websites.
The impact of exploitation extends beyond immediate script execution as it provides attackers with persistent access to user sessions and potentially sensitive information. Successful exploitation could allow unauthorized individuals to perform actions on behalf of victims, including modifying plugin settings, accessing administrative functions, or redirecting users to phishing sites. The vulnerability affects unauthenticated attackers who can leverage this weakness without requiring prior system compromise or elevated privileges.
Mitigation strategies should include immediate patching to version 1.1.53 or later where the input sanitization and output escaping have been properly implemented. Administrators must ensure all WordPress plugins are kept current with security patches, implement proper input validation on all user-supplied parameters, and utilize Content Security Policy headers to limit script execution capabilities. Additionally, organizations should conduct regular security audits of their plugin ecosystem and implement web application firewalls to detect and block malicious input patterns that could exploit similar vulnerabilities in other components.