Vulnerability · Published Aug 22, 2026 · Assigned by WPScan

CVE-2026-76789Slider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers

High 8.8

In plain English

A high-severity cross-site scripting in Slider Hero with Video Background, Animation from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 56.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be executed in the context of an administrator viewing the Slider Hero with Video Background, Animation WordPress plugin before 9.1.3's admin area, as well as any visitor of a page embedding a slider.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Slider Hero with Video Background, Animation	0 – before 9.1.3

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/f9f5485c-6231-492c-b214-8da87a2bf4d1/ exploit, vdb-entry, technical-description