EUVD-2026-53714
GHSA-mrw5-7p4v-67jq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L for required Author-level authentication; UI:R because a victim must visit the injected page for payload execution; S:C for cross-user session impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Slider, Gallery, and Carousel by MetaSlider - Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ml-slider custom post type is registered without custom capability restrictions and the ml-slider_settings meta key is unprotected, allowing Author-level users to set the malicious delay value via XML-RPC custom_fields when creating an ml-slider post.
AnalysisAI
Stored XSS in the MetaSlider WordPress plugin (versions up to and including 3.111.0) allows authenticated Author-level users to inject arbitrary JavaScript via the unprotected 'delay' post meta setting, which executes in the browser of any visitor who loads a page containing the affected slider. The attack path leverages the WordPress XML-RPC API: the ml-slider custom post type is registered without custom capability restrictions and the ml-slider_settings meta key is unprotected, enabling Author-level accounts to plant persistent payloads that bypass normal UI-layer permission checks. This vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis; a patched release (3.111.1) is confirmed by the WordPress plugin SVN changeset.
Technical ContextAI
MetaSlider registers a WordPress custom post type 'ml-slider' for managing image and video slideshows. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) manifests in two places: the 'delay' value written to the ml-slider_settings post meta key is not sanitized on input and not escaped on output, as visible in the vulnerable code at metaslider.class.php lines 54 and 660, metaslider.flex.class.php line 346, and ml-slider.php lines 449 and 604. The compounding design flaw is that the ml-slider CPT is registered without capability restrictions, which means standard WordPress role enforcement does not gate who can create ml-slider posts or write arbitrary values to their meta keys. The XML-RPC API's custom_fields parameter provides a programmatic path to write these meta values, bypassing any admin-UI restrictions that might otherwise block Author-level users from touching plugin settings. The CPE identifier cpe:2.3:a:metaslider:slider,_gallery,_and_carousel_by_metaslider_-_image_slider,_video_slider:*:*:*:*:*:*:*:* covers all affected releases.
RemediationAI
Upgrade MetaSlider to version 3.111.1 or later; the fix is confirmed by the WordPress plugin SVN changeset (https://plugins.trac.wordpress.org/changeset?old_path=%2Fml-slider/tags/3.111.0&new_path=%2Fml-slider/tags/3.111.1) and the specific sanitization commit at https://plugins.trac.wordpress.org/changeset/3633208/ml-slider/trunk/inc/slider/metaslider.class.php. Where immediate upgrade is not feasible, disable XML-RPC site-wide by adding add_filter('xmlrpc_enabled', '__return_false') to functions.php or via a dedicated security plugin - this closes the specific attack path by which Author-level users bypass UI permission checks; note that disabling XML-RPC breaks Jetpack connectivity, mobile app publishing, and other XML-RPC-dependent integrations. As a secondary control, audit all Author-level and Contributor accounts on multi-user sites and remove unnecessary accounts; reducing the authenticated user pool directly limits who can exploit this class of vulnerability. Neither workaround replaces patching - apply the upgrade as the primary remediation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today