Smart Slider 3 CVE-2026-14876

Requires an authenticated account with contributor-level access or above on a WordPress site running Smart Slider 3 (nextendweb) version 3.5.1.38 or earlier; the attacker injects the payload through the 'data-href' parameter of a slider. Exploitation is limited by the need for valid contributor+ credentials (PR:L) - it is not exploitable by anonymous visitors. No end-user interaction is needed to plant the payload (UI:N), but the malicious script only fires when another user subsequently views the injected page, so impact depends on a victim loading that content. Realistic risk is highest on sites that allow open contributor registration or have many low-trust editorial accounts.

This is a moderate-severity, authenticated stored XSS with realistic but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N = 6.4) shows a network-reachable, low-complexity flaw, but PR:L means an attacker must already hold contributor-level (or higher) credentials on the WordPress site - this is the single biggest limiting factor. The scope change (S:C) reflects that injected script executes in the browser context of any user viewing the page, including higher-privileged admins, which is the classic privilege-escalation vector for contributor-tier XSS. Exploitation status: no public exploit identified at time of analysis - no POC, no CISA KEV entry, and no EPSS score was supplied, so there is no evidence of active or automated exploitation. No SSVC decision data was provided. The signals are internally consistent (Wordfence-classified stored XSS, changeset patch on plugins.trac.wordpress.org), so no vector/description conflict exists. Net: a real but not urgent priority - patch in normal cadence; it is not a high-CVSS-but-fake issue, yet the contributor-auth precondition keeps it well below a mass-exploitation threat.

An attacker who has registered or acquired a contributor-level account on a Smart Slider 3-enabled WordPress site injects a malicious payload into the 'data-href' parameter of a slider, which is stored without sufficient sanitization. When an administrator or visitor later views the page containing the slider, the script executes in their session, enabling cookie/session theft or actions performed as the higher-privileged victim. No public exploit code was identified at time of analysis.