Stored Cross-Site Scripting in Slippy Slider Plugin for WordPress

CVE-2025-11874

What is CVE-2025-11874?

The Slippy Slider – Responsive Touch Navigation Slider plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) attacks. This vulnerability arises from inadequate input sanitization and output escaping within the 'slippy-slider' shortcode, affecting all versions up to and including 2.0. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject arbitrary web scripts into pages, leading to code execution whenever users access those compromised pages. As a result, this could potentially compromise user data and the overall integrity of the affected WordPress site.

References