Stored Cross-Site Scripting in Slider Hero with Video Background WordPress Plugin

Executive Summary

This vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in the Slider Hero with Video Background, Animation WordPress plugin before version 9.1.3. It occurs because the plugin lacks authorization and nonce checks on two request handlers and fails to escape a stored setting before outputting it. Attackers can inject malicious JavaScript that executes when an administrator views the plugin's admin area or when visitors access a page with an embedded slider.

Useful 0 Not Useful 0

Detection Guidance

Check if the Slider Hero WordPress plugin version is below 9.1.3. Inspect admin pages and embedded sliders for unusual JavaScript execution or unexpected content. Review server logs for unauthorized POST requests to plugin handlers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to inject malicious JavaScript into the plugin's settings. When an administrator views the plugin's admin area or visitors access a page with an embedded slider, the injected script executes. This could lead to unauthorized actions, data theft, or further compromise of the WordPress site.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, which may violate GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance risks include fines, legal action, and reputational damage due to compromised user data or administrative control.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Slider Hero plugin to version 9.1.3 or later immediately. Remove any suspicious JavaScript snippets from plugin settings. Restrict admin access to trusted users only.

Useful 0 Not Useful 0