EUVD-2026-51794
GHSA-j3m7-4pfh-6m64
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS; PR:N as no credentials needed; UI:R victim must click; S:C script runs in browser outside server scope.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsive_thumbnail_image_management() function, which echoes $_GET['id'] directly into a double-quoted HTML attribute with no esc_attr() call. The only guard is a loose PHP numeric comparison ($_GET['id']>0) that a string beginning with a numeric prefix trivially satisfies, and the addslashes() applied by wp_magic_quotes() is inert in HTML-attribute context because backslash is not an HTML escape character. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
AnalysisAI
Reflected XSS in the WP Responsive Thumbnail Slider WordPress plugin (all versions before 1.1.53) enables unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by crafting a malicious URL containing the 'id' parameter. The vulnerable surface is the responsive_thumbnail_image_management() function, which echoes raw GET input into an HTML attribute without esc_attr() and whose only guard - a loose PHP numeric comparison - is trivially bypassed by any string prefixed with a digit. Exploitation requires social engineering a privileged WordPress user into clicking the crafted link; no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The plugin is a PHP-based WordPress plugin (WP Responsive Thumbnail Slider) whose administrative image management function at wp-responsive-images-thumbnail-slider.php lines 1274-1275 (per the plugin's Trac repository) reflects the $_GET['id'] parameter directly into a double-quoted HTML attribute context. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: the function omits WordPress's canonical esc_attr() output escaping function. A single numeric guard ($_GET['id'] > 0) is bypassed by PHP's loose type comparison, which coerces strings beginning with a digit to their numeric prefix (e.g., '1<img onerror=...>' evaluates to 1). WordPress core's wp_magic_quotes() applies addslashes() to superglobals, but this is inert in HTML attribute context - backslash has no special meaning in HTML, so the escaping provides zero protection against the injection. No CPE string was provided in the intelligence data; the affected product is identified by plugin slug 'wp-responsive-thumbnail-slider'.
RemediationAI
Upgrade the WP Responsive Thumbnail Slider plugin to version 1.1.53 or later, which resolves the missing esc_attr() call in the responsive_thumbnail_image_management() function. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c7370cbc-f681-49d7-9330-762443202529 provides further upgrade guidance. If immediate upgrade is not feasible, restrict access to the WordPress admin panel - and specifically the affected management page - to trusted IP addresses via web server ACLs or a security plugin such as Wordfence with its virtual patching capability, which may apply a rule for this CVE identifier. Deploying a Content Security Policy header that disallows inline scripts (script-src 'self') will reduce the exploitability of the XSS if it fires, though this may break other admin-panel JavaScript on the site and requires testing before deployment.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today