5415 matches found
PT-2026-82858
The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
WordPress Smart Slider 3 plugin <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'slider' Block Attribute vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Smart Slider 3 versions = 3.5.1.38...
CVE-2026-76789
The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...
CVE-2026-76789 Slider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers
The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...
CVE-2026-76789
The Slider Hero with Video Background, Animation WordPress plugin versions before 9.1.3 is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) . The flaw exists because two request handlers—specifically the Slider Type Change and Add-Slider handlers—lack proper authorisation and nonce...
EUVD-2026-64223
The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...
CVE-2026-76789 Slider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers
The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...
CVE-2026-16260 Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...
WordPress Post Grid, Slider & Carousel Ultimate plugin < 1.8.1 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Post Grid, Slider & Carousel Ultimate versions 1.8.1...
PT-2026-79514
Name of the Vulnerable Software and Affected Versions Slider Hero with Video Background, Animation WordPress plugin versions prior to 9.1.3 Description Lack of authorization and nonce checks on two request handlers, combined with a failure to escape a stored setting before output, allows...
CVE-2026-76789: Improper Neutralization of Input During Web Page Generation
The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...
CVE-2026-16260: Improper Neutralization of Input During Web Page Generation
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...
WordPress Depicter plugin < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import vulnerability
Editor+ Arbitrary File Upload via ZIP Import vulnerability discovered by md. minaruzzaman shovon in WordPress Plugin Depicter Slider versions 4.8.0...
WordPress Slick Slider plugin < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode vulnerability
Contributor+ Stored XSS via Gallery Shortcode vulnerability discovered by testoun in WordPress Plugin Slick Slider versions 0.5.3...
CVE-2026-15049: Unrestricted Upload of File with Dangerous Type
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...
WordPress BNE Testimonials plugin < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode vulnerability
Contributor+ Stored XSS via Slider Shortcode vulnerability discovered by testoun in WordPress Plugin BNE Testimonials versions 2.0.8.2...
CVE-2026-66635
Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...
CVE-2026-66622
Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...