CVE-2026-9022: Splide Carousel Block XSS Vulnerability

CVE-2026-9022 Overview

CVE-2026-9022 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Splide Carousel Block plugin for WordPress. The flaw affects all versions up to and including 1.7.1. It originates from insufficient input sanitization and output escaping on the url block attribute. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into posts. The injected payload executes when site visitors load the affected page, but only after an editor or administrator approves and publishes the contributor's content.

Critical Impact
Authenticated contributors can plant persistent JavaScript that runs in the browser of any visitor viewing the published page, enabling session theft, redirection, and admin-context actions.

Affected Products

Splide Carousel Block plugin for WordPress, versions through 1.7.1
WordPress sites allowing contributor-or-higher account registration
WordPress installations where the plugin's carousel blocks are exposed in published content

Discovery Timeline

2026-05-27 - CVE-2026-9022 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-9022

Vulnerability Analysis

The Splide Carousel Block plugin registers a Gutenberg block that accepts a url attribute on carousel items. The plugin fails to sanitize this attribute on input and does not escape it on output when the block renders. As a result, attacker-controlled content placed into the url attribute is rendered into the page HTML without neutralization. An authenticated user with contributor permissions can save a post containing a crafted block payload. When the post is later published and viewed, the browser parses and executes the injected script in the context of the site's origin.

Root Cause

The root cause is missing input validation and missing output escaping on a block attribute under user control. The plugin treats the url value as trusted markup rather than as untrusted data requiring contextual escaping. Block rendering paths in build/carousel-item/index.js and build/carousel/view.js emit the attribute directly into the DOM. Standard WordPress escaping helpers such as esc_url, esc_attr, or equivalent JavaScript-side sanitization are not applied to constrain the value to a safe URL scheme.

Attack Vector

An attacker authenticates to WordPress with a contributor account. The attacker creates a post that includes a Splide carousel block and supplies a malicious payload through the url attribute, for example a javascript: URI or HTML-breaking content that introduces a <script> element. The post must then be approved and published by an editor or administrator, which is the normal workflow for contributor submissions. Once published, every visitor loading the page triggers execution of the injected script under the site's origin, allowing cookie theft, forced navigation, or actions performed against authenticated admin sessions.

No verified exploit code is publicly documented. See the Wordfence Vulnerability Analysis and the affected files in Plugin Index.js and Plugin View.js for technical context.

Detection Methods for CVE-2026-9022

Indicators of Compromise

Published posts containing Splide carousel blocks whose url attribute holds javascript:, data:, or HTML-breaking characters such as ", <, or >.
Unexpected <script> tags or inline event handlers rendered inside carousel markup on public pages.
Outbound browser requests from visitors to unfamiliar third-party domains correlated with views of carousel-bearing pages.

Detection Strategies

Scan the WordPress wp_posts table for wp:splide-carousel block markup containing non-http(s) URI schemes in the url attribute.
Review the plugin version in use and flag any installation at or below 1.7.1.
Inspect rendered HTML of public pages with carousel blocks for script content not present in the originating block source.

Monitoring Recommendations

Monitor contributor and author account activity for new post submissions containing carousel blocks with unusual attribute payloads.
Alert on editorial publish events that promote contributor content containing the Splide block until the plugin is patched.
Track Content Security Policy (CSP) violation reports for inline script execution on pages using the plugin.

How to Mitigate CVE-2026-9022

Immediate Actions Required

Update the Splide Carousel Block plugin to a version newer than 1.7.1 once the vendor publishes a fixed release.
Audit existing posts and pages for carousel blocks containing suspicious url attribute values and remove or sanitize them.
Restrict the ability to add or edit Splide carousel blocks to trusted roles until the plugin is updated.

Patch Information

The plugin's repository tracks remediation under the WordPress Changeset Overview. Administrators should upgrade to the fixed release identified in that changeset and verify the installed version through the WordPress plugin dashboard.

Workarounds

Deactivate the Splide Carousel Block plugin until a patched version is installed.
Revoke or downgrade contributor-level accounts that do not require post submission privileges.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted URI schemes on the front end.
Require editorial review of any post containing third-party blocks before publication.

bash

# Configuration example: identify and disable the vulnerable plugin via WP-CLI
wp plugin get splide-carousel --field=version
wp plugin deactivate splide-carousel
wp plugin update splide-carousel