Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be executed in the context of an administrator viewing the Slider Hero with Video Background, Animation WordPress plugin before 9.1.3's admin area, as well as any visitor of a page embedding a slider.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-76789 The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does n… https://www.cve.org/CVERecord?id=CVE-2026-76789
Post summary
The Slider Hero plugin (before version 9.1.3) has missing authorisation and nonce checks on two request handlers, exposing it to potential unauthorized exploitation (CVE‑2026‑76789).
CVE-2026-76789 Stored XSS in Slider Hero WordPress Plugin Before 9.1.3 Allows Administrator Account Takeover https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-76789
Post summary
A stored XSS vulnerability in Slider Hero WordPress plugin (versions before 9.1.3) allows attackers to compromise administrator accounts.