CVE-2026-18344

Name of the Vulnerable Software and Affected Versions Wp Responsive Thumbnail Slider versions prior to 1.1.53

Description Reflected Cross-Site Scripting occurs when unauthenticated attackers trick users into clicking a specially crafted link. The issue stems from insufficient input sanitization and output escaping within the responsive thumbnail image management() function, which directly echoes the id parameter into a double-quoted HTML attribute without using esc attr(). A loose PHP numeric comparison is used as a guard, but it can be bypassed by strings starting with a numeric prefix. Additionally, the addslashes() function applied by wp magic quotes() is ineffective in an HTML-attribute context because backslashes are not HTML escape characters.

Recommendations Update to version 1.1.53 or later. As a temporary workaround, avoid using the id parameter in the affected plugin functions until the update is applied.