WordPress Plugin Stored XSS via Missing Authorization Checks

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be executed in the context of an administrator viewing the Slider Hero with Video Background, Animation WordPress plugin before 9.1.3's admin area, as well as any visitor of a page embedding a slider.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Slider Hero with Video Background, Animation WordPress plugin before version 9.1.3 contains a critical stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious JavaScript into plugin settings. The vulnerability stems from two critical flaws: missing authorization checks on request handlers and failure to escape stored settings before output. This means any visitor to a website can inject malicious code that persists in the database and executes in the browsers of administrators and site visitors. Organizations using this popular WordPress plugin are at immediate risk of account compromise, credential theft, malware distribution, and complete site takeover.

Casky's 322 mapped security skills detect the attack patterns underlying this vulnerability by tracking initial access vectors (TA0001) and privilege escalation techniques (TA0043). Practitioners using Casky would observe findings related to unauthenticated request handling, missing CSRF/nonce validation patterns, and stored payload injection signatures. The platform's Claude AI-powered analysis would identify the chain: attackers bypass authorization controls to reach vulnerable endpoints, inject JavaScript into database fields, and trigger execution when those fields render without sanitization. Security teams would see recommendations mapping to input validation, output encoding, and authentication enforcement across MITRE ATT&CK techniques, enabling them to prioritize remediation and hunt for similar patterns in other WordPress installations.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-76789.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-76789

Casky has 322 skills that investigate the attack patterns behind CVE-2026-76789. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn