GSlider Blocks <= 1.2.1 - Authenticated (Contributor+) CSS Injection via 'blockStyle' Block Attribute
- ID
- WPSEC-2026-2821
- Plugin
- GSlider Blocks (gslider-blocks)
- Affected
- all versions before 1.2.2
- Remediation
- Update to 1.2.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-10
- Attack surface
- GSlider Blocks on WPSec AttackSurface
- Fix released
- Published
Description
The GSlider Blocks plugin for WordPress is vulnerable to CSS Injection via the 'blockStyle' block attribute in all versions up to, and including, 1.2.1, due to insufficient scoping of user-supplied CSS. Releases before 1.2.0 printed the attribute's CSS on the page without any selector scoping. From 1.2.0, a selector was accepted if it merely contained the block ID anywhere, and the block ID itself was not validated, so an empty block ID let every selector through. The same unscoped CSS was also returned in the plugin's REST API 'css' field. This makes it possible for authenticated attackers, with contributor-level access and above, to inject page-wide CSS rules that style elements outside the slider block. This could be used to deface pages, overlay content for UI redress attacks against site visitors, or exfiltrate page attribute values through attribute selectors with external url() requests.
References
- https://wpsec.com/vuln/WPSEC-2026-2821/
- https://plugins.svn.wordpress.org/gslider-blocks/tags/1.2.2/
- https://wordpress.org/plugins/gslider-blocks/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS