PLUGIN SECURITY
Is Ml Slider safe?
Slider, gallery, carousel plugin for WordPress. Build your image slider, video slider, post slider, YouTube slider, or WooCommerce product slider.
What this plugin does
- Slug:
ml-slider - Author: MetaSlider
- 500000+ active installs
- 92/100 rating (737 reviews on wordpress.org)
- 34987558 all-time downloads
- On WordPress.org since 2013-02-15
carousel slidergalleryimage sliderslidervideo slider
Maintenance status
- Latest known version: 3.111.2
- Last updated: 2026-08-19 7:51pm GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.0+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
13 known CVEs on file for Ml Slider.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-39467 | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.107.0 | Deserialization of Untrusted Data | High 7.2 | < 3.107.0 | 3.107.0 | 2026-04-20 | ✓ fixed in latest |
| CVE-2026-39465 | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.107.0 | Improper Control of Generation of Code ('Code Injection') | Critical 9.1 | < 3.107.0 | 3.107.0 | 2026-04-20 | ✓ fixed in latest |
| CVE-2026-18400 | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.111.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 3.111.1 | 3.111.1 | 2026-04-20 | ✓ fixed in latest |
| CVE-2025-26763 | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.95.0 | Deserialization of Untrusted Data | Critical 9.8 | < 3.95.0 | 3.95.0 | 2025-02-14 | ✓ fixed in latest |
| CVE-2025-24533 | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.92.1 | Cross-Site Request Forgery (CSRF) | Medium 5.4 | < 3.92.1 | 3.92.1 | 2024-11-09 | ✓ fixed in latest |
| CVE-2024-3285 | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.70.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.70.1 | 3.70.1 | 2024-04-10 | ✓ fixed in latest |
| — | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.29.1 | — | Unknown | < 3.29.1 | 3.29.1 | 2023-03-22 | ✓ fixed in latest |
| CVE-2022-47150 | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.28.1 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 3.28.1 | 3.28.1 | 2023-03-21 | ✓ fixed in latest |
+ 17 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2023-1473 | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.29.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.29.1 | 3.29.1 | 2023-03-20 | ✓ fixed in latest |
| CVE-2022-2823 | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.27.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 3.27.9 | 3.27.9 | 2022-09-14 | ✓ fixed in latest |
| — | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.17.2 | — | Unknown | < 3.17.2 | 3.17.2 | 2020-09-17 | ✓ fixed in latest |
| — | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.17.2 | — | Unknown | < 3.17.2 | 3.17.2 | 2020-08-28 | ✓ fixed in latest |
| — | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 2.2 | — | Unknown | < 2.2 | 2.2 | 2015-10-27 | ✓ fixed in latest |
| — | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 2.2 | — | Unknown | < 2.2 | 2.2 | 2014-08-01 | ✓ fixed in latest |
| CVE-2014-4846 | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 2.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 2.6 | 2.6 | 2014-07-10 | ✓ fixed in latest |
| — | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.95.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Low 3.5 | < 3.95.0 | 3.95.0 | 0000-00-00 | ✓ fixed in latest |
| — | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.99.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.99.0 | 3.99.0 | 0000-00-00 | ✓ fixed in latest |
| — | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.17.2 | — | Unknown | < 3.17.2 | 3.17.2 | — | ✓ fixed in latest |
| — | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 2.2 | — | Unknown | < 2.2 | 2.2 | — | ✓ fixed in latest |
| — | Meta Slider 2.1.6 - Multiple Full Path Disclosure | — | Unknown | < 2.2 | 2.2 | — | ✓ fixed in latest |
| — | MetaSlider < 3.17.2 - Authenticated Stored Cross-Site Scripting (XSS) | — | Unknown | < 3.17.2 | 3.17.2 | — | ✓ fixed in latest |
| CVE-2023-1473 | Responsive WordPress Slideshows 3.29.0 - Reflected XSS | — | Unknown | < 3.29.1 | 3.29.1 | — | ✓ fixed in latest |
| CVE-2025-1062 | Slider, Gallery, Carousel by MetaSlider < 3.95.0 - Editor+ Stored XSS | — | Unknown | < 3.95.0 | 3.95.0 | — | ✓ fixed in latest |
| CVE-2025-1203 | Slider, Gallery, Carousel by MetaSlider < 3.95.0 - Editor+ Stored XSS | — | Unknown | < 3.95.0 | 3.95.0 | — | ✓ fixed in latest |
| CVE-2025-5337 | Slider, Gallery, and Carousel by MetaSlider < 3.99.0 - Contributor+ Stored XSS via aria-label Parameter | — | Unknown | < 3.99.0 | 3.99.0 | — | ✓ fixed in latest |
How to fix it
Keep Ml Slider updated — 3.111.2 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Smart Slider 3 — 800000+ active installs — 98/100 (1123) — max PHP <8.0
- Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery — 300000+ active installs — 86/100 (4339) — max PHP 8.4
- Firelight Lightbox — 200000+ active installs — 96/100 (355) — max PHP 8.4
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery — 100000+ active installs — 90/100 (1581)
- Gallery : FooGallery — 100000+ active installs — 96/100 (986)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.