Serious Slider
Monthly
Stored Cross-Site Scripting in the Serious Slider WordPress plugin (all versions up to and including 1.4.0) allows authenticated contributors to inject persistent malicious scripts via the 'theme' shortcode attribute, which then execute in the browser of any user who subsequently visits the affected page. The flaw originates from insufficient sanitization and output escaping in multiple code paths within inc/shortcodes.php, as confirmed by Wordfence and EUVD-2026-59867. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
The Serious Slider WordPress plugin before 1.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Cryout Creations Serious Slider allows Stored XSS.2.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored Cross-Site Scripting in the Serious Slider WordPress plugin (all versions up to and including 1.4.0) allows authenticated contributors to inject persistent malicious scripts via the 'theme' shortcode attribute, which then execute in the browser of any user who subsequently visits the affected page. The flaw originates from insufficient sanitization and output escaping in multiple code paths within inc/shortcodes.php, as confirmed by Wordfence and EUVD-2026-59867. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
The Serious Slider WordPress plugin before 1.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Cryout Creations Serious Slider allows Stored XSS.2.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.