B Slider CVE-2026-115961

Exploitation requires an authenticated WordPress account with sufficient privileges to submit or edit B Slider content (PR:L per the CVSS vector - plugin content-contribution capability such as contributor/author), and requires a victim with a browser session to view the rendered slider content (UI:R), typically a higher-privileged user or administrator for meaningful impact. The specific plugin field, parameter, or admin screen where the stored payload is injected and rendered is not described in the available sources. Limiting factors: exploitation is not fully unauthenticated, it depends on victim interaction, and impact is confined to the browser context of whoever views the malicious content; it only applies where the B Slider plugin (version ≤2.2.2) is installed and lower-privileged users can author slider content.

This is a stored cross-site scripting (CWE-79) flaw in the bPlugins 'B Slider' WordPress plugin with a reported CVSS 3.1 base score of 6.5 (vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The vector signals network-reachable, low-complexity exploitation but requires some level of existing privilege (PR:L - i.e. authenticated per the vector) and victim interaction (UI:R), with a changed scope reflecting XSS execution in the victim's browser context and limited impact to confidentiality, integrity, and availability. The vuln.today decision label is 'this_month', indicating a moderate, non-emergency priority. No EPSS score was provided, there is no CISA KEV listing (so it is NOT confirmed actively exploited), and the single reference is a Patchstack advisory entry rather than verified working exploit code. On balance this is a real but routine stored-XSS issue typical of the WordPress plugin ecosystem - meaningful where the plugin is installed and lower-privileged users can submit content, but not an emergency; the lack of EPSS and the absence of any confirmed exploit mean widespread opportunistic exploitation is unproven. EPSS data is missing, which limits probabilistic assessment.

A user with at least low-privilege authenticated access (e.g. contributor or author) injects a malicious script payload into a B Slider field that is stored and later rendered without proper neutralization. When a higher-privileged user such as an administrator views the page or admin screen where the slider content is displayed (UI:R), the script executes in their browser session, potentially enabling session/credential theft or admin-context actions. No confirmed working public exploit was identified at time of analysis; only a Patchstack advisory reference exists.