CVE-2026-76789 Overview
CVE-2026-76789 is a stored Cross-Site Scripting (XSS) vulnerability in the Slider Hero with Video Background, Animation WordPress plugin before version 9.1.3. The plugin exposes two request handlers that lack authorization and nonce checks. Unauthenticated attackers can invoke these handlers to store arbitrary settings, and the plugin fails to escape one of those values before output. The injected JavaScript executes in the browser of any administrator viewing the plugin admin area and any visitor loading a page that embeds a slider. The vulnerability is tracked under CWE-79.
Critical Impact
Unauthenticated attackers can inject persistent JavaScript that runs in administrator sessions, enabling account takeover and full WordPress site compromise.
Affected Products
- Slider Hero with Video Background, Animation WordPress plugin versions prior to 9.1.3
- WordPress sites with the plugin activated and reachable over the network
- Site visitors rendering pages that embed a Slider Hero slider
Discovery Timeline
- 2026-08-22 - CVE-2026-76789 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-76789
Vulnerability Analysis
The plugin registers two request handlers that write plugin settings without validating the requester's identity or verifying a WordPress nonce. Because both authorization and Cross-Site Request Forgery (CSRF) protections are absent, any unauthenticated HTTP client can submit setting values directly. At least one of the stored settings is later rendered into HTML without being passed through an output-escaping function such as esc_html(), esc_attr(), or wp_kses(). This turns a configuration write into a persistent script injection primitive.
Execution occurs in two contexts. Administrators visiting the plugin's admin screens load the tainted setting into the WordPress dashboard, exposing them to session theft, privilege abuse via the REST API, and arbitrary plugin or theme modification. Site visitors loading a public page that embeds a slider execute the same payload in their browsers, expanding the impact to drive-by attacks against end users.
Root Cause
The root cause is a combination of missing access control on state-changing endpoints and missing output encoding on a stored value. WordPress requires current_user_can() capability checks and check_admin_referer() or wp_verify_nonce() calls on setting handlers. The plugin omitted both. It additionally trusted stored input at render time, violating the WordPress escape-on-output guidance.
Attack Vector
An attacker sends an unauthenticated HTTP POST to the vulnerable AJAX or admin-post handler with a JavaScript payload placed in the vulnerable setting field. The payload persists in the WordPress options table. When an administrator opens the plugin page, or a visitor loads a page containing the slider shortcode or block, the browser parses and executes the stored script under the site's origin.
No verified public exploit code is currently indexed. See the WPScan Vulnerability Report for advisory details.
Detection Methods for CVE-2026-76789
Indicators of Compromise
- Unauthenticated POST requests to Slider Hero AJAX actions or admin-post endpoints originating from unexpected IP addresses
- <script>, onerror=, or javascript: fragments stored in Slider Hero plugin option rows within the wp_options table
- Unexpected outbound requests from administrator browsers to attacker-controlled domains after visiting the plugin admin area
- New administrator accounts or modified user roles created shortly after suspicious plugin traffic
Detection Strategies
- Inspect web server access logs for POST requests to Slider Hero handlers that lack a valid _wpnonce parameter or authenticated session cookie
- Query the wp_options table for Slider Hero settings containing HTML tags, event handlers, or URL-encoded script markers
- Deploy a Web Application Firewall (WAF) rule to flag XSS payloads targeting the plugin's request handlers
Monitoring Recommendations
- Alert on creation or modification of WordPress administrator accounts and on changes to active plugins or themes
- Monitor administrator browser sessions for anomalous REST API calls immediately after visiting wp-admin plugin pages
- Correlate unauthenticated plugin endpoint access with subsequent authenticated administrator activity from the same session cookies
How to Mitigate CVE-2026-76789
Immediate Actions Required
- Update the Slider Hero with Video Background, Animation plugin to version 9.1.3 or later on every WordPress instance
- Audit the wp_options table for Slider Hero entries and remove any values containing script content or HTML event handlers
- Rotate credentials and session tokens for all WordPress administrators who accessed the plugin admin area before patching
- Review recent administrator activity, installed plugins, and user role changes for signs of exploitation
Patch Information
The vendor addressed the issue in Slider Hero with Video Background, Animation version 9.1.3 by adding authorization and nonce validation on the affected request handlers and escaping the stored setting on output. Refer to the WPScan Vulnerability Report for advisory metadata.
Workarounds
- Deactivate and remove the Slider Hero plugin until the site can be upgraded to 9.1.3 or later
- Restrict access to wp-admin/admin-ajax.php and wp-admin/admin-post.php at the WAF layer for unauthenticated requests targeting Slider Hero actions
- Enforce a strict Content Security Policy (CSP) that disallows inline scripts to reduce the impact of stored XSS payloads
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
