CVE-2026-17582

Name of the Vulnerable Software and Affected Versions Slider Hero versions prior to 9.1.8

Description An issue exists where authenticated attackers with administrator-level access can perform a second-order SQL Injection. While slide data such as description, title, btn, btn2, image link, and custom is stored safely, the qcld sliderhero duplicate() function fails to sanitize this data when the 'heroduplicateslider' task is triggered. The function concatenates raw values directly into an INSERT VALUES tuple executed via $wpdb->query(), bypassing security functions like $wpdb->prepare(), esc sql(), or real escape string. This allows the execution of additional SQL queries to extract sensitive information from the database.

Recommendations Update to a version newer than 9.1.7. As a temporary workaround, avoid using the qcld sliderhero duplicate() function or triggering the 'heroduplicateslider' task until the update is applied.