Quantumcloud Slider Hero
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Quantumcloud Slider Hero.
By the Year
In 2026 there have been 1 vulnerability in Quantumcloud Slider Hero with an average score of 4.9 out of ten. Slider Hero did not have any published security vulnerabilities last year. That is, 1 more vulnerability have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 1 | 4.90 |
| 2025 | 0 | 0.00 |
| 2024 | 1 | 0.00 |
| 2023 | 2 | 4.30 |
| 2022 | 1 | 4.80 |
| 2021 | 1 | 8.80 |
It may take a day or so for new Slider Hero vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Quantumcloud Slider Hero Security Vulnerabilities
WordPress Slider Hero <=9.1.7 SecondOrder SQLi via heroduplicateslider
CVE-2026-17582
4.9 - Medium
- August 16, 2026
The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data (description, title, btn, btn2, image_link, custom, etc.) is stored safely via $wpdb->update() with %s placeholders in the qchero_save_image AJAX handler, but when an administrator triggers the 'heroduplicateslider' task, qcld_sliderhero_duplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb->query() with no $wpdb->prepare(), esc_sql(), or _real_escape_string in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
SQL Injection
Quantum Cloud Slider Hero Stored XSS (<=8.6.1)
CVE-2024-29922
- March 27, 2024
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Quantum Cloud Slider Hero allows Stored XSS.This issue affects Slider Hero: from n/a through 8.6.1.
XSS
Slider Hero WP Plugin <=8.2.0 CSRF via nonce check bypass
CVE-2021-4424
4.3 - Medium
- July 12, 2023
The Slider Hero plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.2.0. This is due to missing or incorrect nonce validation on the qc_slider_hero_duplicate() function. This makes it possible for unauthenticated attackers to duplicate slides via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Session Riding
Common Vulnerability in unspecified software (CVE-2021-4342)
CVE-2021-4342
- June 07, 2023
** REJECT ** CVE split into individual CVE IDs for each software record.
CVE-2022-3074 Slider Hero WP Plugin XSS via Unescaped Slider Name (before 8.4.4)
CVE-2022-3074
4.8 - Medium
- September 26, 2022
The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks.
XSS
The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement
CVE-2021-24506
8.8 - High
- August 23, 2021
The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users with a role as low as Contributor to perform SQL injection.
SQL Injection
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Quantumcloud Slider Hero or by Quantumcloud? Click the Watch button to subscribe.
