The vulnerability exists in versions of the Slider Hero with Video Background, Animation WordPress plugin older than 9.1.3. Two request handlers lack proper authorisation and nonce validation, and a stored configuration value is not escaped before being output. This allows an unauthenticated user to submit malicious JavaScript that is persisted and later executed in the context of any administrator viewing the plugin’s admin area and on any site page that embeds a slider. The consequence is arbitrary script execution which could be leveraged to hijack admin sessions, exfiltrate credentials, or redirect users to malicious sites.

WordPress sites that have the Slider Hero with Video Background, Animation plugin installed and running a version prior to 9.1.3. Site administrators and public visitors who load pages containing sliders are at risk, as the stored payload is rendered unfiltered within the slider markup.

Although an EPSS score is not available and the vulnerability is not listed in CISA KEV, the lack of authentication combined with stored XSS suggests a high exploitation probability in environments where the plugin is enabled. An attacker requires only the ability to send data to the vulnerable endpoints, which can be accomplished through a simple web request; no privileged credentials are necessary. The impact is significant because the JavaScript runs with the privileges of the viewing user, allowing credential theft or further lateral movement.