CVE-2026-18400: MetaSlider WordPress Plugin XSS Vulnerability

CVE-2026-18400 Overview

CVE-2026-18400 is a stored Cross-Site Scripting (XSS) vulnerability in the Slider, Gallery, and Carousel by MetaSlider plugin for WordPress. The flaw affects all versions up to and including 3.111.0 and stems from insufficient input sanitization and output escaping on the delay post meta setting. Authenticated attackers with custom-level access or above can inject arbitrary JavaScript that executes when a user views an affected page. The vulnerability is tracked as [CWE-79] and carries a CVSS score of 6.4.

Critical Impact
Author-level users can inject persistent JavaScript into MetaSlider posts via XML-RPC custom_fields, executing scripts in the context of any visitor who loads the affected slider page.

Affected Products

Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress
All versions up to and including 3.111.0
Fixed in version 3.111.1

Discovery Timeline

2026-08-06 - CVE-2026-18400 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-18400

Vulnerability Analysis

The vulnerability resides in how the MetaSlider plugin handles the delay value stored in the ml-slider_settings post meta. When the slider is rendered, the plugin reads this value and outputs it into slider markup and JavaScript initialization without sufficient escaping. Because the value is persisted in the database, any script payload injected into the delay setting executes for every visitor who loads a page containing the affected slider. This makes the issue a stored XSS rather than a reflected one, increasing its impact on multi-user WordPress sites.

Root Cause

Two design decisions combine to enable exploitation. First, the ml-slider custom post type is registered without custom capability restrictions, so users at Author level can create ml-slider posts. Second, the ml-slider_settings meta key is not registered as protected, allowing arbitrary values including the delay field to be written through standard meta APIs. The rendering code then trusts this value and emits it into page output without applying context-appropriate escaping such as esc_attr() or esc_js().

Attack Vector

Exploitation is performed over the network by an authenticated attacker holding at least Author-level access. The attacker sends an XML-RPC request using the custom_fields parameter while creating a new ml-slider post, setting ml-slider_settings[delay] to a JavaScript payload. When any user later loads a page containing that slider, the injected script executes in the visitor's browser, enabling session theft, forced administrative actions, or client-side redirection. Because the scope is Changed (S:C), the impact extends beyond the vulnerable component to the visiting user's session context. Technical references to the vulnerable code paths are available in the WordPress MetaSlider plugin source and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-18400

Indicators of Compromise

Presence of ml-slider custom post types created by non-administrative accounts, particularly Author-level users
ml-slider_settings post meta entries containing HTML tags, <script> fragments, on* event handlers, or javascript: URIs in the delay value
XML-RPC requests to /xmlrpc.php invoking wp.newPost or metaWeblog.newPost with custom_fields targeting ml-slider_settings
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading a slider page

Detection Strategies

Query the wp_postmeta table for meta_key = 'ml-slider_settings' and inspect serialized values for script content or non-numeric delay fields
Review web server logs for POST requests to xmlrpc.php correlated with Author-level accounts
Deploy a Web Application Firewall (WAF) rule that inspects XML-RPC bodies for ml-slider_settings payloads containing HTML or script syntax

Monitoring Recommendations

Alert on creation of ml-slider posts by users outside the Editor and Administrator roles
Log and review all XML-RPC custom_fields write operations targeting slider meta keys
Monitor for anomalous JavaScript execution or DOM modifications on pages hosting MetaSlider content using client-side security monitoring

How to Mitigate CVE-2026-18400

Immediate Actions Required

Update the MetaSlider plugin to version 3.111.1 or later on all WordPress installations
Audit existing ml-slider posts and their ml-slider_settings meta for injected script payloads and remove or sanitize any suspicious entries
Review WordPress user roles and downgrade unnecessary Author-level accounts to Contributor or Subscriber where feasible

Patch Information

The vendor released a fix in MetaSlider version 3.111.1. The relevant code changes are documented in the WordPress MetaSlider Change Set and the 3.111.0 to 3.111.1 diff. Applying this patch adds proper sanitization and escaping for the delay value.

Workarounds

Disable XML-RPC on the WordPress site if it is not required, for example by blocking /xmlrpc.php at the web server or WAF layer
Restrict the ability to create ml-slider posts to Editor or Administrator roles using a capability management plugin until the patch is applied
Temporarily deactivate the MetaSlider plugin on sites where an immediate upgrade is not possible

bash

# Nginx example: block XML-RPC access as a temporary mitigation
location = /xmlrpc.php {
    deny all;
    return 403;
}