EUVD-2026-67399
GHSA-mcvf-8xhh-c3q4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor credentials required (PR:L); scope change to admin browser session (S:C); no availability impact; low confidentiality and integrity impact via session hijack.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected scripts execute specifically when a user opens the affected post in the WordPress block editor, making Editors and Administrators the primary targets.
AnalysisAI
Stored Cross-Site Scripting in Smart Slider 3 (WordPress plugin by Nextend) versions up to and including 3.5.1.38 allows authenticated contributors to inject persistent JavaScript payloads via the Gutenberg 'slider' block attribute, targeting Editors and Administrators who subsequently open affected posts in the WordPress block editor. The flaw originates from insufficient input sanitization in the Gutenberg block integration and missing output escaping in the plugin's shortcode renderer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a minimum of contributor-level authentication on the target WordPress installation; unauthenticated attackers cannot trigger this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.4 Medium score is well-calibrated for this vulnerability class: AV:N reflects web delivery, PR:L captures the contributor authentication prerequisite, and S:C accounts for the cross-session impact when a privileged user's browser executes the payload. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Smart Slider 3 to version 3.5.1.39 or later, which contains a fix to the Gutenberg block attribute handling as shown in the plugin repository changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Fsmart-slider-3/tags/3.5.1.38&new_path=%2Fsmart-slider-3/tags/3.5.1.39. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Smart Slider 3
View allThe Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PH
The Smart Slider 3 WordPress plugin before 3.5.1.14 does not properly validate and escape some of its shortcode attribut
Smart Slider 3 plugin for WordPress through version 3.5.1.33 allows authenticated attackers with Contributor-level acces
Directory traversal in the Smart Slider 3 WordPress plugin (all versions ≤ 3.5.1.36) exposes arbitrary server-side files
Deserialization of Untrusted Data vulnerability in Nextend Smart Slider 3.5.1.9. Rated medium severity (CVSS 4.3), this
Sensitive information exposure in the Smart Slider 3 WordPress plugin (all versions up to and including 3.5.1.37) allows
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today