CVE-2026-18400 metaslider CVE debrief

Who should care

Users of the Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress, especially those with custom-level access and above, should be aware of this vulnerability. They should verify their installed plugin versions, restrict custom-level access, and monitor for suspicious activity. Additionally, they should apply vendor remediation when available and review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0. This vulnerability is caused by insufficient input sanitization and output escaping. Authenticated attackers with custom-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability exists due to the unprotected ml-slider_settings meta key and the lack of custom capability restrictions on the ml-slider custom post type.

Defensive priority

Authenticated attackers with custom-level access could inject web scripts, requiring immediate attention.

Recommended defensive actions

• Inventory and verify installed plugin versions.
• Restrict custom-level access and above.
• Monitor for suspicious activity.
• Apply vendor remediation when available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The ml-slider custom post type is registered without custom capability restrictions and the ml-slider_settings meta key is unprotected, allowing Author-level users to set the malicious delay value via XML-RPC custom_fields when creating an ml-slider post. This lack of protection and insufficient input sanitization enable attackers to inject arbitrary web scripts. To verify, defenders should review the plugin's post meta settings and custom post type registrations for similar vulnerabilities. Additionally, they should monitor for suspicious activity related to the ml-slider post type and XML-RPC requests.

Official resources