Atomic Edge analysis of CVE-2026-24383:
The B Slider WordPress plugin, versions up to and including 2.0.6, contains an authenticated stored cross-site scripting (XSS) vulnerability. The vulnerability exists in the plugin’s slider management interface, allowing contributors and higher-privileged users to inject malicious scripts. The CVSS score of 6.4 reflects the medium severity of this issue, which requires authentication but leads to persistent script execution.
Atomic Edge research identified insufficient input sanitization and output escaping as the root cause. The vulnerability likely resides in the plugin’s frontend block rendering or admin dashboard components where user-supplied slider content is processed. The provided code diff shows version number updates and build asset changes, but the actual security fix involves modifications to input handling functions not displayed in the diff. The vulnerability affects the core slider data processing logic.
An attacker with contributor-level access or higher can exploit this vulnerability by creating or editing a slider. The attacker injects malicious JavaScript payloads into slider content fields, such as titles, descriptions, or custom HTML attributes. When an administrator or any site visitor views a page containing the compromised slider, the injected script executes in their browser context. The attack vector is the plugin’s slider editor, accessible via the WordPress block editor or classic editor interface.
The patch in version 2.0.7 addresses the vulnerability by implementing proper input sanitization on user-controlled data before storage and applying output escaping when rendering slider content. The version bump from 2.0.6 to 2.0.7 and the updated build asset hashes indicate changes to the underlying JavaScript and PHP code responsible for processing slider attributes. The fix ensures that HTML and script content from users is treated as untrusted data.
Successful exploitation allows attackers to perform actions within the context of an authenticated user’s session. This can lead to session hijacking, administrative account takeover, defacement of site content, or redirection to malicious sites. Since the payload is stored in the database, the attack persists across sessions and affects all users who view the compromised slider, amplifying the impact.
