Vulnerability-Lookup

CVE-2026-17582 (GCVE-0-2026-17582)

Vulnerability from cvelistv5 – Published: 2026-08-16 05:27 – Updated: 2026-08-16 05:27

Title

Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)

Summary

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data (description, title, btn, btn2, image_link, custom, etc.) is stored safely via $wpdb->update() with %s placeholders in the qchero_save_image AJAX handler, but when an administrator triggers the 'heroduplicateslider' task, qcld_sliderhero_duplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb->query() — with no $wpdb->prepare(), esc_sql(), or _real_escape_string in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

Wordfence

References

6 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/slider…
https://plugins.trac.wordpress.org/browser/slider…
https://plugins.trac.wordpress.org/browser/slider…
https://plugins.trac.wordpress.org/browser/slider…
https://plugins.trac.wordpress.org/changeset?repo…

Impacted products

1 product

Vendor	Product	Version
quantumcloud	Slider Hero with Video Background, Animation	Affected: 0 , ≤ 9.1.7 (semver)

Credits

Wordfence PRISM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Slider Hero with Video Background, Animation",
          "vendor": "quantumcloud",
          "versions": [
            {
              "lessThanOrEqual": "9.1.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data (description, title, btn, btn2, image_link, custom, etc.) is stored safely via $wpdb-\u003eupdate() with %s placeholders in the qchero_save_image AJAX handler, but when an administrator triggers the \u0027heroduplicateslider\u0027 task, qcld_sliderhero_duplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb-\u003equery() \u2014 with no $wpdb-\u003eprepare(), esc_sql(), or _real_escape_string in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-16T05:27:30.357Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b36621-3322-4631-b693-629c5084708b?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/slider-hero/tags/9.1.6/qcld-slider-main.php#L392"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/slider-hero/tags/9.1.7/qcld-slider-main.php#L392"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/slider-hero/tags/9.1.7/qcld-slider-main.php#L1206"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/slider-hero/tags/9.1.6/qcld-slider-main.php#L1206"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3635315%40slider-hero\u0026new=3635315%40slider-hero"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-04T11:32:41.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-15T16:26:49.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Slider Hero with Video Background, Animation \u003c= 9.1.7 - Authenticated (Administrator+) SQL Injection via \u0027description\u0027 Slide Field (Second-Order via Duplicate)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-17582",
    "datePublished": "2026-08-16T05:27:30.357Z",
    "dateReserved": "2026-07-27T15:49:06.835Z",
    "dateUpdated": "2026-08-16T05:27:30.357Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-17582\",\"sourceIdentifier\":\"security@wordfence.com\",\"published\":\"2026-08-16T06:16:51.563\",\"lastModified\":\"2026-08-16T06:16:51.563\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data (description, title, btn, btn2, image_link, custom, etc.) is stored safely via $wpdb-\u003eupdate() with %s placeholders in the qchero_save_image AJAX handler, but when an administrator triggers the \u0027heroduplicateslider\u0027 task, qcld_sliderhero_duplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb-\u003equery() \u2014 with no $wpdb-\u003eprepare(), esc_sql(), or _real_escape_string in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\"}],\"affected\":[{\"source\":\"security@wordfence.com\",\"affectedData\":[{\"vendor\":\"quantumcloud\",\"product\":\"Slider Hero with Video Background, Animation\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"9.1.7\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@wordfence.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@wordfence.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"references\":[{\"url\":\"https://plugins.trac.wordpress.org/browser/slider-hero/tags/9.1.6/qcld-slider-main.php#L1206\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/browser/slider-hero/tags/9.1.6/qcld-slider-main.php#L392\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/browser/slider-hero/tags/9.1.7/qcld-slider-main.php#L1206\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/browser/slider-hero/tags/9.1.7/qcld-slider-main.php#L392\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3635315%40slider-hero\u0026new=3635315%40slider-hero\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b36621-3322-4631-b693-629c5084708b?source=cve\",\"source\":\"security@wordfence.com\"}]}}"
  }
}

GHSA-VXQ7-R2MM-G784

Vulnerability from github – Published: 2026-08-16 06:30 – Updated: 2026-08-16 06:30

Details

Severity

4.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-17582"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-16T06:16:51Z",
    "severity": "MODERATE"
  },
  "details": "The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data (description, title, btn, btn2, image_link, custom, etc.) is stored safely via $wpdb-\u003eupdate() with %s placeholders in the qchero_save_image AJAX handler, but when an administrator triggers the \u0027heroduplicateslider\u0027 task, qcld_sliderhero_duplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb-\u003equery() \u2014 with no $wpdb-\u003eprepare(), esc_sql(), or _real_escape_string in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
  "id": "GHSA-vxq7-r2mm-g784",
  "modified": "2026-08-16T06:30:26Z",
  "published": "2026-08-16T06:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17582"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/slider-hero/tags/9.1.6/qcld-slider-main.php#L1206"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/slider-hero/tags/9.1.6/qcld-slider-main.php#L392"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/slider-hero/tags/9.1.7/qcld-slider-main.php#L1206"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/slider-hero/tags/9.1.7/qcld-slider-main.php#L392"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3635315%40slider-hero\u0026new=3635315%40slider-hero"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b36621-3322-4631-b693-629c5084708b?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-17582 (GCVE-0-2026-17582)

GHSA-VXQ7-R2MM-G784

Tags

Sightings

Nomenclature