# Image Slider Block <= 1.4.1 - Authenticated (Contributor+) CSS Injection via Block Style Attributes

- **ID:** WPSEC-2026-3030
- **Plugin:** Image Slider Block (`slider-block`), https://wordpress.org/plugins/slider-block/
- **Affected versions:** from 1.3.2 before 1.5.0
- **Fixed in:** 1.5.0 (Update to 1.5.0 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-74
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/slider-block
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3030/

## Description

The Image Slider Block plugin for WordPress is vulnerable to CSS Injection via block style attributes (blockMeta, commonStyles and customCss) in all versions up to, and including, 1.4.1, due to insufficient sanitization of block CSS saved by users without the unfiltered_html capability before it is written to the post's public stylesheet. Versions before 1.4.1 do not filter this CSS at all. The filter added in 1.4.1 can be bypassed with CSS comments that hide a url() from its pattern, with non-hex CSS escapes in function names such as u\rl(, and with an unclosed url() at the end of the stylesheet. This makes it possible for authenticated attackers with contributor-level access and above to place CSS in the stylesheet served with a post. That CSS can load off-site resources and use attribute selectors to exfiltrate page data from users who view the page.

## References

- https://wpsec.com/vuln/WPSEC-2026-3030/
- https://plugins.svn.wordpress.org/slider-block/tags/1.5.0/
- https://wordpress.org/plugins/slider-block/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3030/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.