Slider Gallery And Carousel By Metaslider Image Slider Video Slider
Monthly
Stored XSS in the MetaSlider WordPress plugin (versions up to and including 3.111.0) allows authenticated Author-level users to inject arbitrary JavaScript via the unprotected 'delay' post meta setting, which executes in the browser of any visitor who loads a page containing the affected slider. The attack path leverages the WordPress XML-RPC API: the ml-slider custom post type is registered without custom capability restrictions and the ml-slider_settings meta key is unprotected, enabling Author-level accounts to plant persistent payloads that bypass normal UI-layer permission checks. This vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis; a patched release (3.111.1) is confirmed by the WordPress plugin SVN changeset.
Stored XSS in the MetaSlider WordPress plugin (versions up to and including 3.111.0) allows authenticated Author-level users to inject arbitrary JavaScript via the unprotected 'delay' post meta setting, which executes in the browser of any visitor who loads a page containing the affected slider. The attack path leverages the WordPress XML-RPC API: the ml-slider custom post type is registered without custom capability restrictions and the ml-slider_settings meta key is unprotected, enabling Author-level accounts to plant persistent payloads that bypass normal UI-layer permission checks. This vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis; a patched release (3.111.1) is confirmed by the WordPress plugin SVN changeset.