CVE-2026-18400 describes a stored cross-site scripting vulnerability in the Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider WordPress plugin. The issue arises from improper neutralization of input in the 'delay' post meta setting, allowing authenticated attackers with custom-level access or higher to inject malicious scripts. The ml-slider custom post type lacks custom capability restrictions, and the ml-slider_settings meta key is unprotected, enabling Author-level users to set malicious values via XML-RPC custom_fields. This vulnerability affects all versions up to and including 3.111.0. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with no availability impact.

An authenticated attacker with custom-level access or higher can inject stored malicious scripts via the 'delay' meta setting, which execute in the context of users viewing the affected pages. This can lead to unauthorized actions or data disclosure consistent with cross-site scripting impacts. The vulnerability affects confidentiality and integrity but does not impact availability. The lack of capability restrictions on the ml-slider custom post type and unprotected meta keys increases the risk by allowing Author-level users to exploit the flaw via XML-RPC.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to XML-RPC and limit user roles to trusted users only. Monitor for plugin updates from MetaSlider and apply official patches once released. Avoid granting custom-level or Author-level access to untrusted users to reduce exploitation risk.