The vulnerability exists in versions of the Slider Hero with Video Background, Animation WordPress plugin older than 9.1.3. Two request handlers lack proper authorisation and nonce validation, and a stored configuration value is not escaped before outputting. This allows an unauthenticated user to submit malicious JavaScript that is persisted and later executed in the context any administrator viewing the plugin’s admin area and on any site page that embeds a slider. The consequence is arbitrary script execution which could be leveraged to hijack admin sessions, exfiltrate credentials, or redirect users to malicious sites.

WordPress sites that have the Slider Hero with Video Background, Animation plugin installed and running a version prior to 9.1.3. Site administrators and public visitors who load pages containing sliders are at risk, as the stored payload is rendered unfiltered within the slider markup.

Although an EPSS score of <1% indicates a low probability of exploitation, the vulnerability is not listed in CISA KEV and the CVSS score of 8.8 indicates high impact. The lack of authentication combined with stored XSS makes it technically easy for an attacker to submit malicious JavaScript that is persisted and later executed in the context of any administrator viewing the plugin’s admin area and on any site page that embeds a slider. An attacker needs only the ability to send data to the vulnerable endpoints, which can be accomplished through a simple web request; no privileged credentials are necessary. The impact is significant because the JavaScript runs with the privileges of the viewing user, allowing credential theft or further lateral movement.