CVE-2026-18344: WordPress Thumbnail Slider XSS Flaw

CVE-2026-18344 Overview

CVE-2026-18344 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the WP Responsive Thumbnail Slider plugin for WordPress in all versions prior to 1.1.53. The flaw resides in the responsive_thumbnail_image_management() function, which echoes the id GET parameter directly into an HTML attribute without proper sanitization or escaping. Unauthenticated attackers can craft malicious links that execute arbitrary JavaScript in a victim's browser when clicked.

Critical Impact
Successful exploitation allows attackers to execute arbitrary scripts in the context of a victim's authenticated WordPress session, enabling session theft, forced administrative actions, and content manipulation.

Affected Products

WP Responsive Thumbnail Slider plugin for WordPress, versions up to and excluding 1.1.53
WordPress sites with the affected plugin installed and active
Any user browser that renders reflected content from the vulnerable endpoint

Discovery Timeline

2026-08-01 - CVE-2026-18344 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18344

Vulnerability Analysis

The vulnerability originates in the responsive_thumbnail_image_management() function of the WP Responsive Thumbnail Slider plugin. This function accepts the id query parameter from $_GET and inserts it directly into a double-quoted HTML attribute. No call to esc_attr() or equivalent output-escaping function is performed before rendering.

The only validation applied is a loose PHP numeric comparison of the form $_GET['id']>0. Because PHP performs implicit type juggling in loose comparisons, any string beginning with a numeric prefix (for example, 1" onmouseover=alert(1) x=") satisfies this check while still carrying an XSS payload. The addslashes() function applied by wp_magic_quotes() provides no protection here because a backslash is not an HTML metacharacter and cannot neutralize attribute-context injection.

Root Cause

The root cause is insufficient input sanitization combined with missing output encoding in HTML-attribute context. The developer relied on a numeric comparison as a security control, a pattern that fails against PHP's type-juggling behavior. Reflected user input reached the browser without contextual escaping, satisfying the classic conditions for [CWE-79].

Attack Vector

An attacker crafts a URL to the vulnerable endpoint with a malicious payload appended to the id parameter. The attacker then distributes this link through phishing email, social media, or a malicious page. User interaction is required: the victim must click the link. When the page renders, the injected script executes under the WordPress site's origin. If the victim is an authenticated administrator, the attacker inherits their privileges within that page context.

See the Wordfence Vulnerability Analysis and WordPress Plugin Code Review for the exact affected source lines.

Detection Methods for CVE-2026-18344

Indicators of Compromise

HTTP requests to WordPress endpoints containing an id query parameter with non-numeric content, HTML tag characters (<, >), event handlers (onerror, onmouseover), or javascript: URIs.
Referer headers originating from external domains combined with suspicious id parameter payloads.
Web server access logs showing repeated probes against the WP Responsive Thumbnail Slider plugin paths with encoded script fragments (%3Cscript, %22, %27).

Detection Strategies

Deploy WordPress-aware web application firewall (WAF) rules that inspect the id parameter for script tags, event handlers, and encoded HTML metacharacters.
Correlate outbound browser telemetry with inbound reflected content to identify user-triggered execution of injected payloads.
Review plugin inventory across WordPress hosts and flag any installation of WP Responsive Thumbnail Slider below version 1.1.53.

Monitoring Recommendations

Enable verbose web server access logging and retain query strings for at least 90 days to support post-incident review.
Monitor administrator session activity for unexpected content-management actions immediately following a click on an external link.
Alert on Content Security Policy (CSP) violation reports that reference inline script execution on pages served by the vulnerable plugin.

How to Mitigate CVE-2026-18344

Immediate Actions Required

Update the WP Responsive Thumbnail Slider plugin to version 1.1.53 or later on every affected WordPress site.
If an immediate update is not possible, deactivate and remove the plugin until the patched version can be deployed.
Instruct administrators to avoid clicking untrusted links to the WordPress site, particularly those containing an id parameter.

Patch Information

The vendor addressed the issue in version 1.1.53 of the WP Responsive Thumbnail Slider plugin. The fix applies proper output escaping to the id parameter within the responsive_thumbnail_image_management() function. Refer to the WordPress Plugin Code Review for the corrected source location.

Workarounds

Deploy a WAF rule that blocks requests to the vulnerable endpoint when the id parameter contains characters other than digits.
Enforce a strict Content Security Policy that disallows inline scripts and unsanctioned event handlers to reduce the impact of any reflected payload.
Restrict access to WordPress administrative sessions by requiring re-authentication after inactivity and using separate browsers or profiles for administrative tasks.

bash

# Example ModSecurity rule blocking non-numeric 'id' parameter values
SecRule ARGS:id "!@rx ^[0-9]+$" \
    "id:1002026,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2026-18344: Non-numeric id parameter blocked'"