CVE-2025-5337

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Slider, Gallery, and Carousel by MetaSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘aria-label’ parameter in all versions up to, and including, 3.98.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
metaslider	Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider	<= 3.98.0

References

Timeline

Published: Jun 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-533705.4Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions s CVE-2025-533719.1DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel. DiscordNotificatio CVE-2025-533727.5node-code-sandbox-mcp is a Node.js–based Model Context Protocol server that spins up disposable Docker containers to execute arbitrary JavaS CVE-2025-533738.9Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the CVE-2025-533744.3Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An auth CVE-2025-533756.5Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An auth CVE-2025-533768.8Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An auth CVE-2025-533776.1WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cadastro_depe CVE-2025-533789.8A missing authentication vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an unauthentica CVE-2025-533797.5A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remot CVE-2025-53385.4The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and CVE-2025-53397.5The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘bsa