{
 "id": "WPSEC-2026-1762",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1762/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1762/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1762/index.md",
 "title": "Image Slider Block <= 1.4.0 - Authenticated (Contributor+) Site-Wide CSS Injection via Reusable Block 'ref'",
 "description": "The Image Slider Block plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 1.4.0, due to missing validation of the core/block 'ref' attribute: any post ID was accepted as a reusable block, its block CSS was written to a public stylesheet, and the IDs were saved to a site-wide option whose stylesheets load on every front-end page. This makes it possible for authenticated attackers, with contributor-level access and above, to make CSS from an unpublished draft load on every page of the site, which can be used to deface pages or send page data to another host.",
 "plugin": {
  "slug": "slider-block",
  "name": "Image Slider Block",
  "full_name": "Image Slider Block",
  "wordpress_org": "https://wordpress.org/plugins/slider-block/",
  "advisories_url": "https://wpsec.com/vuln/plugin/slider-block/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/slider-block"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-74"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.3.3",
    "from_inclusive": true,
    "to": "1.4.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.3.3 before 1.4.1"
  ]
 },
 "introduced_in": "1.3.3",
 "fixed_in": "1.4.1",
 "remediation": "Update to 1.4.1 or later.",
 "fix_released": "2026-10-26T14:26:02+00:00",
 "published": "2026-10-27T14:45:37+00:00",
 "updated": "2026-10-27T13:39:50.930852+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1762/",
  "https://plugins.svn.wordpress.org/slider-block/tags/1.4.1/",
  "https://wordpress.org/plugins/slider-block/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/slider-block",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}