Slider Hero EUVD-2026-64223

No authentication is required (CVSS PR:N confirmed). The Slider Hero with Video Background, Animation plugin must be installed and activated on the target WordPress site. Two separate impact paths exist with distinct triggering conditions: (1) Admin-context XSS requires that a WordPress administrator navigates to the plugin's admin area after the payload is injected - this is a normal administrative action with no unusual configuration needed. (2) Visitor-context XSS requires that the site has at least one public-facing page embedding a Slider Hero slider widget, and that a visitor loads that page. Non-default conditions limiting exploitation include: the plugin must be active (not merely installed), and for the admin vector, an admin must view the plugin settings; for the visitor vector, at least one slider-embedded page must exist. Network access to the WordPress instance's AJAX endpoint is required. No special server configuration, non-default plugin settings, or privileged position on the network is needed beyond internet reachability.

The NVD-assigned CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects the low attack complexity and lack of authentication requirement, tempered by the need for user interaction. The scope metric (S:U) in the provided vector is arguably conservative: successful exploitation of the admin-context vector enables an attacker to execute JavaScript as a privileged WordPress administrator, potentially leading to full site takeover - a scope change that would support S:C. Against this elevated theoretical risk, the EPSS score of 0.19% (8th percentile) suggests this vulnerability has not attracted widespread exploitation tooling or campaigns at time of analysis, and there is no CISA KEV listing and no POC reported. The practical priority depends on plugin prevalence in the target environment: sites running the Slider Hero plugin on internet-accessible WordPress installations with public-facing slider pages are meaningfully exposed, as the unauthenticated injection step requires no credentials. The visitor-facing XSS surface further increases the blast radius beyond a typical stored admin-XSS. Overall, this is a genuine high-severity issue warranting prompt patching, but the low EPSS indicates it has not yet been operationalized by threat actors.

An unauthenticated attacker sends a crafted HTTP POST request directly to the plugin's unprotected AJAX handler, supplying a JavaScript payload (e.g., a cookie-stealing script or admin account creation routine) as a slider setting value. No account or session cookie is required. The payload is persisted in the WordPress database. Subsequently, when a site administrator opens the Slider Hero admin settings page - a routine action - the stored JavaScript executes in the administrator's browser session, enabling session token theft or arbitrary WordPress administrative actions. Concurrently, any visitor loading a public page that embeds a slider also executes the payload, enabling credential phishing, drive-by malware delivery, or defacement at scale. No public POC has been identified at time of analysis.