EUVD-2026-53733
GHSA-gvvh-735h-j96c
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Contributor auth required (PR:L), victim must view post (UI:R), payload persists in DB (VI:L), and XSS executes in victim browser scope (S:C/C:L).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when a user views the affected post.
AnalysisAI
Stored Cross-Site Scripting in the Slick Slider WordPress plugin before 0.5.3 allows any authenticated user holding the Contributor role or higher to inject persistent JavaScript through an unsanitized shortcode attribute value that is rendered directly into an HTML attribute. The payload executes in the browser of any user - including administrators - who subsequently views the affected post, enabling session hijacking, credential theft, or privilege escalation. A publicly available proof-of-concept exploit exists and a vendor patch (version 0.5.3) has been released; no active exploitation has been confirmed by CISA KEV at time of analysis.
Technical ContextAI
The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), a stored XSS variant. WordPress shortcodes allow contributors to embed dynamic content in posts; this plugin processes a shortcode attribute and writes its value into an HTML attribute in the rendered page output without applying WordPress sanitization functions (such as esc_attr()) or output encoding. Because the payload is persisted in the WordPress database at post-save time and replayed to every viewer, this is a stored (persistent) XSS rather than a reflected variant. The affected CPE is cpe:2.3:a:unknown:slick_slider:*:*:*:*:*:*:*:*, covering all versions of the plugin prior to 0.5.3 in the WordPress ecosystem.
RemediationAI
Update the Slick Slider WordPress plugin to version 0.5.3 or later, which introduces proper output escaping on the affected shortcode attribute. The vendor-confirmed patch is documented in the WPScan advisory at https://wpscan.com/vulnerability/8de9a050-45b5-4e51-9cd9-06f85999393a/. If an immediate upgrade is not feasible, restrict the WordPress Contributor role to fully trusted users only, as no unauthenticated or anonymous exploitation path exists. As an additional compensating control, a Web Application Firewall rule blocking common XSS payloads in POST body parameters can reduce risk, though this is not a substitute for patching and may interfere with legitimate shortcode content. Auditing existing posts for shortcodes containing unexpected script or event-handler content is advisable before or alongside patching.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today