EUVD-2026-13982
GHSA-fhwh-m653-p2c2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Any Post Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aps_slider shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on the 'post_type' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
The Any Post Slider WordPress plugin versions up to 1.0.4 contain a Stored Cross-Site Scripting (XSS) vulnerability in the aps_slider shortcode due to insufficient input sanitization and output escaping on the 'post_type' attribute. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that persists in pages and executes for all users who view the injected content. With a CVSS score of 6.4 and attack complexity marked as low, this represents a moderate-severity threat primarily affecting multi-user WordPress installations where contributor access is delegated.
Technical ContextAI
This vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw. The Any Post Slider plugin (CPE: cpe:2.3:a:itpathsolutions:any_post_slider:*:*:*:*:*:*:*:*), developed by ITPATHSolutions, processes the 'post_type' shortcode attribute without proper sanitization before storage or escaping before output in the no_content.php partial template. WordPress shortcodes are processed server-side and stored in post_meta or post_content, making stored XSS particularly dangerous as the malicious payload executes every time the page is rendered, affecting all site visitors regardless of their privilege level. The vulnerability exists across the WordPress plugin ecosystem where shortcode handlers fail to use WordPress security functions like sanitize_text_field() during input processing and esc_attr() or esc_html() during output rendering.
RemediationAI
Update the Any Post Slider plugin to version 1.0.5 or later, which should address the input sanitization and output escaping issues in the aps_slider shortcode's post_type attribute handling. Site administrators should access the WordPress plugin dashboard, navigate to Plugins, locate Any Post Slider, and select Update if available; if no update is published, disable or remove the plugin until a security patch is released. As an interim mitigation, restrict Contributor-level access to only trusted users and audit existing pages containing the aps_slider shortcode for suspicious post_type values. Enable WordPress security hardening by activating a Web Application Firewall (such as Wordfence Free or Sucuri) to detect and block XSS payloads. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/562f194f-1f32-4de4-8074-84580f653bdb?source=cve) for confirmation of patch availability and any interim recommendations from the plugin vendor.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today