CVE-2026-76789 in Slider Hero with Video Background, Animation Plugin
Summary
by MITRE • 08/22/2026
The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be executed in the context of an administrator viewing the Slider Hero with Video Background, Animation WordPress plugin before 9.1.3's admin area, as well as any visitor of a page embedding a slider.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified in versions of the Slider Hero with Video Background and Animation plugin prior to version 9.1.3 represents a critical security failure rooted in inadequate input validation and output encoding mechanisms within its administrative interface. The core technical flaw consists of two distinct but related issues: the absence of authorization checks on specific request handlers and the lack of proper escaping for stored settings before they are rendered in the browser. In WordPress development, nonces (number used once) and capability checks are essential safeguards that ensure only authenticated users with appropriate permissions can execute administrative actions. By omitting these controls, the plugin exposes endpoints to unauthenticated actors who can manipulate server-side state without any form of identity verification or permission validation. This architectural oversight allows external parties to send crafted HTTP requests that trigger internal logic intended solely for authorized administrators, effectively bypassing the standard security perimeter established by the WordPress core authentication system.
The second component of this vulnerability involves a stored cross-site scripting (XSS) flaw resulting from insufficient output escaping. When user-supplied data is accepted through these unprotected endpoints and subsequently saved into the database as part of a slider configuration or setting, it is not sanitized against special characters before being retrieved for display. Consequently, when an administrator accesses the plugin's admin area to view or edit sliders, or when any visitor loads a webpage containing a slider configured with malicious content, the browser interprets the injected script tags as executable code rather than static text. This execution occurs within the security context of the victim user, granting the attacker the ability to run arbitrary JavaScript commands that have full access to cookies, session tokens, and local storage associated with the WordPress environment. The persistence of this data means the attack does not require repeated exploitation attempts; once stored, the malicious payload remains active until manually removed from the database or the plugin is updated.
The operational impact of this vulnerability is severe due to its potential for widespread compromise across multiple user types. For administrators, successful exploitation can lead to complete site takeover, as attackers often leverage XSS in admin panels to perform actions such as creating new administrator accounts, modifying theme files, installing malicious plugins, or exfiltrating sensitive database contents. The ability to execute scripts means an attacker could also redirect users to phishing sites, deface the website by altering its visual presentation, or use the compromised server for further attacks against other networked systems. For regular visitors, while they may not have administrative privileges, their browsers can still be manipulated to perform actions on behalf of authenticated administrators if session cookies are accessible, potentially leading to account hijacking through techniques like cross-site request forgery facilitated by the stolen credentials or tokens. The dual nature of this flaw—allowing both unauthorized state changes and persistent script injection—amplifies the risk profile significantly compared to isolated vulnerabilities.
Industry standards classify these issues under specific categories that highlight their severity and remediation requirements. The lack of authorization checks aligns with CWE-862, which denotes Missing Authorization, indicating a failure to enforce access controls on protected resources. Furthermore, the storage and subsequent execution of malicious scripts corresponds directly to CWE-79, known as Improper Neutralization of Input During Web Page Generation (Cross-site Scripting). From an offensive security perspective, this vulnerability maps to MITRE ATT&CK techniques such as T1059.007 for JavaScript-based command execution and potentially T1136 if the attacker uses it to create new accounts for persistent access. These mappings underscore that the issue is not merely a coding error but a fundamental breach of secure design principles regarding input handling and privilege management in web applications.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary and most effective solution is to upgrade the Slider Hero plugin to version 9.1.3 or later, where these specific flaws have been patched by implementing proper nonce verification on all administrative endpoints and applying strict output escaping functions such as esc_html or wp_kses_post before rendering user data in HTML contexts. For organizations unable to update immediately due to compatibility constraints, temporary mitigations include restricting access to the WordPress admin area via IP whitelisting if feasible, although this is less robust than fixing the code itself. Additionally, implementing a Web Application Firewall (WAF) can provide an additional layer of defense by filtering out requests that contain suspicious patterns associated with XSS payloads or unauthorized API calls. Regular security audits and adherence to secure coding standards like OWASP Top 10 are essential for preventing similar vulnerabilities in future development cycles, ensuring that all user inputs are treated as untrusted until explicitly validated and sanitized.