CVE-2026-17582: Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate() function. Slide data (description, title, btn, btn2, imagelink, custom, etc.) is stored safely via $wpdb->update() with %s placeholders in the qcherosaveimage AJAX handler, but when an administrator triggers the 'heroduplicateslider' task, qcldsliderheroduplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb->query() — with no $wpdb->prepare(), escsql(), or realescapestring in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.