Image Slider Block <= 1.4.1 - Authenticated (Contributor+) CSS Injection via Block Style Attributes
- ID
- WPSEC-2026-3030
- Plugin
- Image Slider Block (slider-block)
- Affected
- from 1.3.2 before 1.5.0
- Remediation
- Update to 1.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-74
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- Image Slider Block on WPSec AttackSurface
- Fix released
- Published
Description
The Image Slider Block plugin for WordPress is vulnerable to CSS Injection via block style attributes (blockMeta, commonStyles and customCss) in all versions up to, and including, 1.4.1, due to insufficient sanitization of block CSS saved by users without the unfiltered_html capability before it is written to the post's public stylesheet. Versions before 1.4.1 do not filter this CSS at all. The filter added in 1.4.1 can be bypassed with CSS comments that hide a url() from its pattern, with non-hex CSS escapes in function names such as u\rl(, and with an unclosed url() at the end of the stylesheet. This makes it possible for authenticated attackers with contributor-level access and above to place CSS in the stylesheet served with a post. That CSS can load off-site resources and use attribute selectors to exfiltrate page data from users who view the page.
References
- https://wpsec.com/vuln/WPSEC-2026-3030/
- https://plugins.svn.wordpress.org/slider-block/tags/1.5.0/
- https://wordpress.org/plugins/slider-block/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS