{
 "id": "WPSEC-2026-3030",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3030/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3030/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3030/index.md",
 "title": "Image Slider Block <= 1.4.1 - Authenticated (Contributor+) CSS Injection via Block Style Attributes",
 "description": "The Image Slider Block plugin for WordPress is vulnerable to CSS Injection via block style attributes (blockMeta, commonStyles and customCss) in all versions up to, and including, 1.4.1, due to insufficient sanitization of block CSS saved by users without the unfiltered_html capability before it is written to the post's public stylesheet. Versions before 1.4.1 do not filter this CSS at all. The filter added in 1.4.1 can be bypassed with CSS comments that hide a url() from its pattern, with non-hex CSS escapes in function names such as u\\rl(, and with an unclosed url() at the end of the stylesheet. This makes it possible for authenticated attackers with contributor-level access and above to place CSS in the stylesheet served with a post. That CSS can load off-site resources and use attribute selectors to exfiltrate page data from users who view the page.",
 "plugin": {
  "slug": "slider-block",
  "name": "Image Slider Block",
  "full_name": "Image Slider Block",
  "wordpress_org": "https://wordpress.org/plugins/slider-block/",
  "advisories_url": "https://wpsec.com/vuln/plugin/slider-block/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/slider-block"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-74"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.3.2",
    "from_inclusive": true,
    "to": "1.5.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.3.2 before 1.5.0"
  ]
 },
 "introduced_in": "1.3.2",
 "fixed_in": "1.5.0",
 "remediation": "Update to 1.5.0 or later.",
 "fix_released": "2026-11-12T08:30:15+00:00",
 "published": "2026-11-13T08:44:14+00:00",
 "updated": "2026-11-12T17:15:08.442980+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3030/",
  "https://plugins.svn.wordpress.org/slider-block/tags/1.5.0/",
  "https://wordpress.org/plugins/slider-block/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/slider-block",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}