A critical Stored Cross-Site Scripting vulnerability in the Slider Hero WordPress plugin allows unauthenticated attackers to execute malicious scripts, posing a severe risk to administrative sessions and site visitors.

The plugin fails to perform authorization or nonce checks on specific request handlers and neglects to escape stored settings, enabling unauthenticated attackers to inject malicious JavaScript that executes in the context of administrative users or site visitors.

Successful exploitation of this vulnerability could lead to full administrative account compromise if an administrator views the affected settings page, or widespread site defacement and user session theft for visitors of pages where the slider is embedded. With a CVSS score of 8.8, this flaw represents a high risk to organizational integrity and data confidentiality, as it facilitates unauthorized script execution within a trusted site environment.

Immediate Action: Update the Slider Hero with Video Background, Animation plugin to version 9.1.3 or later immediately.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting the plugin request handlers and monitor for unauthorized changes to plugin settings.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common XSS payloads and restrict access to the WordPress administrative dashboard to trusted IP addresses.

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Given the high CVSS score and the potential for complete site compromise, immediate remediation is mandatory. Organizations utilizing this plugin must verify their current version and update to the patched release to prevent unauthorized code execution. If an update cannot be performed immediately, the plugin should be disabled or access to the vulnerable functionality restricted to mitigate the risk of exploitation.