The Slider Hero with Video Background, Animation WordPress plugin versions prior to 9.1.3 contain a CWE-79 Cross-Site Scripting vulnerability due to missing authorization and nonce verification on two request handlers and improper escaping of stored settings before output. This flaw enables unauthenticated attackers to store malicious JavaScript code that executes when an administrator accesses the plugin's admin interface or when a visitor views a page containing the vulnerable slider, potentially leading to administrative session compromise or other script-based attacks.

Unauthenticated attackers can inject and store malicious JavaScript code that executes in the context of administrators and site visitors. This can lead to administrative account compromise, unauthorized actions within the WordPress admin area, or malicious script execution affecting site visitors. The vulnerability affects both the backend admin interface and frontend pages embedding the slider.

No official patch or remediation guidance has been published yet for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the WordPress admin area and consider disabling or removing the vulnerable plugin version to prevent exploitation.