CVE-2025-11874: Slippy Slider WordPress Plugin XSS Flaw

CVE-2025-11874 Overview

CVE-2025-11874 is a Stored Cross-Site Scripting (XSS) vulnerability in the Slippy Slider – Responsive Touch Navigation Slider plugin for WordPress. The flaw exists in the plugin's slippy-slider shortcode across all versions up to and including 2.0. The plugin fails to sanitize user-supplied attributes and does not escape output. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript that executes when any user views the affected page. The issue is tracked under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page.

Critical Impact
Authenticated contributors can inject persistent JavaScript that runs in the browser of any visitor, including administrators, enabling session theft, account takeover, and drive-by redirection.

Affected Products

Slippy Slider – Responsive Touch Navigation Slider plugin for WordPress
All versions up to and including 2.0
WordPress sites permitting contributor-level or higher user registration

Discovery Timeline

2025-11-11 - CVE-2025-11874 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11874

Vulnerability Analysis

The vulnerability resides in the plugin's shortcode handler for slippy-slider. Attribute values passed into the shortcode flow into rendered HTML without sanitization or output escaping. An authenticated user with the contributor role can embed the shortcode inside a draft post and supply attribute values containing HTML or JavaScript payloads. When an editor previews or a visitor loads the resulting page, the injected script executes in the browser under the site's origin. The stored nature of the payload means every subsequent view of the affected page re-triggers execution. Because the attack requires user interaction to load the page, exploitation depends on victims accessing attacker-authored content. See the WordPress plugin source reference for the vulnerable code path.

Root Cause

The root cause is insufficient input sanitization combined with missing output escaping on shortcode attributes. WordPress provides helpers such as esc_attr(), esc_html(), and wp_kses() for exactly this scenario. The plugin does not apply them to attribute values before echoing them into the slider markup. This maps to CWE-80, the improper neutralization of script-related HTML tags in web pages.

Attack Vector

Exploitation requires an authenticated account with contributor privileges or higher. The attacker inserts the slippy-slider shortcode into a post or page with malicious attribute values containing script content or event-handler HTML. After the content is saved and later rendered, the payload executes in the browser context of any user viewing the page, including administrators. Payloads can hijack session cookies, perform authenticated actions via the REST API, or redirect users to attacker-controlled infrastructure. Details are documented in the Wordfence vulnerability report.

// No verified exploit code is publicly available.
// The injection occurs via malicious attribute values passed to the [slippy-slider] shortcode,
// which are then rendered into page HTML without escaping.

Detection Methods for CVE-2025-11874

Indicators of Compromise

Posts or pages containing [slippy-slider] shortcode instances with attribute values that include <script>, javascript:, or HTML event handlers such as onload= and onerror=.
Unexpected outbound requests from visitor browsers to unfamiliar domains when viewing pages created by contributor accounts.
New or modified administrator accounts created shortly after a contributor authored content containing the shortcode.

Detection Strategies

Query the wp_posts table for post_content containing slippy-slider combined with suspicious tokens such as <script, onerror, or onload.
Review audit logs for contributor-level accounts publishing or submitting posts that use the plugin's shortcode.
Inspect rendered HTML of pages using the plugin for script tags or event handlers not originating from theme or plugin templates.

Monitoring Recommendations

Enable a WordPress activity log plugin to record post edits, shortcode usage, and role changes.
Monitor Content Security Policy (CSP) violation reports for inline script executions on pages that embed the slider.
Alert on newly registered contributor accounts followed by immediate post creation activity.

How to Mitigate CVE-2025-11874

Immediate Actions Required

Deactivate the Slippy Slider plugin until a patched version is confirmed installed.
Audit all posts and pages using the [slippy-slider] shortcode and remove any suspicious attribute values.
Review and reduce the number of accounts holding contributor or higher privileges.
Rotate administrator passwords and invalidate active sessions if injection is suspected.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. All versions up to and including 2.0 are vulnerable. Monitor the Wordfence advisory and the plugin's WordPress.org listing for a patched release. Apply updates as soon as a fixed version becomes available.

Workarounds

Restrict content publishing to trusted editor and administrator roles until patched.
Deploy a web application firewall (WAF) rule that blocks shortcode attributes containing script tags or event handlers.
Enforce a strict Content Security Policy that disallows inline scripts on public pages.
Uninstall the plugin if it is not actively required for site functionality.

bash

# Temporarily disable the plugin via WP-CLI until a patch is released
wp plugin deactivate slippy-slider-responsive-touch-navigation-slider

# Search post content for suspicious shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts \
  WHERE post_content LIKE '%slippy-slider%' \
  AND (post_content LIKE '%<script%' \
       OR post_content LIKE '%onerror=%' \
       OR post_content LIKE '%onload=%');"