CVE-2026-18400 is a stored cross-site scripting vulnerability in the Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider WordPress plugin. The flaw exists due to improper neutralization of input in the 'delay' post meta setting, allowing authenticated attackers with custom-level or higher privileges to inject arbitrary web scripts. The ml-slider custom post type lacks custom capability restrictions, and the ml-slider_settings meta key is unprotected, enabling Author-level users to set malicious delay values via XML-RPC custom_fields when creating an ml-slider post. This vulnerability affects all versions up to and including 3.111.0.

An attacker with authenticated access at custom-level or above can inject malicious scripts that execute in the context of users viewing the affected pages, potentially leading to session hijacking, defacement, or other script-based attacks. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and limit access to the XML-RPC interface if possible. Monitor for suspicious activity related to the ml-slider post type and meta keys. Avoid granting custom-level or higher privileges to untrusted users.