CVE-2026-76789: CWE-79 Cross-Site Scripting (XSS) in Slider Hero with Video Background, Animation

CVE-2026-76789 is a high-severity Cross-Site Scripting (CWE-79) vulnerability in the Slider Hero with Video Background, Animation WordPress plugin versions prior to 9.1.3. The vulnerability is due to lack of authorization and nonce verification on two request handlers, combined with improper escaping of stored settings before output. This allows unauthenticated attackers to inject and store malicious JavaScript code, which executes when an administrator accesses the plugin's admin interface or when any visitor views a page containing the vulnerable slider. The CVSS v3.1 base score is 8.8, indicating a high impact on confidentiality, integrity, and availability.

Successful exploitation enables unauthenticated attackers to execute arbitrary JavaScript in the context of administrators and site visitors. This can lead to full compromise of administrator accounts, site defacement, theft of sensitive information, and potential further attacks on users. The vulnerability affects both the admin area and public-facing pages embedding the slider.

A fixed version 9.1.3 or later should be applied to remediate this vulnerability. Since no explicit patch links or vendor advisory are provided, users should verify availability of the official update from the plugin vendor or WordPress plugin repository. Until patched, restrict access to the plugin's admin area and avoid embedding the vulnerable slider on public pages if possible.