MetaSlider <= 3.111.0 Authenticated Stored XSS via delay Post Meta (CVE-2026-18400)

Vulnerability Overview Vulnerability Name: Slider, Gallery, and Carousel by MetaSlider <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'delay' Post Meta Setting CVE ID: CVE-2026-18400 CVSS Score: 6.4 (Medium) Publication Date: August 5, 2026 Last Updated: August 6, 2026 Researcher: haofanjiukunle Scope of Impact Software Type: Plugin Software Name: Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider Affected Versions: <= 3.111.0 Fixed Versions: 3.111.1 or later Remediation Remediation Advice: Upgrade to version 3.111.1 or later patched versions. Vulnerability Description This vulnerability allows authenticated attackers (Author level and above) to inject arbitrary web scripts when creating new slider posts by setting malicious delay values. These scripts are executed when users visit the affected pages because the custom post type registration lacks custom capability restrictions, and the meta key is unprotected. References plugins.trac.wordpress.org Additional Information Software Slug: ml-slider Patch Status: Patched Recent Related Vulnerabilities: - CVE-2026-39467: Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider <= 3.106.0 - Authenticated (Editor+) PHP Object Injection - CVE-2026-39465: Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider <= 3.106.0 - Authenticated (Editor+) Remote Code Execution - CVE-2025-5337: Slider, Gallery, and Carousel by MetaSlider <= 3.98.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via aria-label Parameter - CVE-2025-12103: Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider <= 3.94.0 - Authenticated (Admin+) Stored Cross-Site Scripting - CVE-2025-1062: Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider <= 3.94.0 - Authenticated (Editor+) Stored Cross-Site Scripting - CVE-2025-26763: Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider <= 3.94.0 - Authenticated (Editor+) PHP Object Injection - CVE-2025-24533: Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider <= 3.92.0 - Cross-Site Request Forgery - CVE-2024-3285: Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshow <= 3.70.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via metaslider_shortcode - CVE-2023-1473: Slider, Gallery, and Carousel by MetaSlider <= 3.29.0 - Reflected Cross-Site Scripting - CVE-2022-121: Appsero <= 1.2.1 - Missing Authorization Summary This vulnerability is a stored cross-site scripting (XSS) flaw affecting Slider, Gallery, and Carousel by MetaSlider plugin versions <= 3.111.0. Attackers can inject arbitrary web scripts by setting malicious delay values, affecting users who visit the affected pages. Upgrading to version 3.111.1 or later is recommended to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

MetaSlider <= 3.111.0 Authenticated Stored XSS via delay Post Meta (CVE-2026-18400)

More from this source