Slider Hero with Video Background, Animation <= 9.1.7 — Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Slider Hero with Video Background, Animation.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 9.1.8, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Slider Hero with Video Background, Animation to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Wordfence PRISM.

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data (description, title, btn, btn2, image_link, custom, etc.) is stored safely via $wpdb->update() with %s placeholders in the qchero_save_image AJAX handler, but when an administrator triggers the 'heroduplicateslider' task, qcld_sliderhero_duplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb->query() — with no $wpdb->prepare(), esc_sql(), or _real_escape_string in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Aug 15, 2026

   CVE published

   Severity medium, CVSS 4.9

2. Nov 13, 2026

   Record last updated