Smart Slider 3 CVE-2026-15798

Exploitation requires a minimum of contributor-level authentication on the target WordPress installation; unauthenticated attackers cannot trigger this vulnerability. Beyond authentication, the stored payload only executes when a user with Editor or Administrator role opens the specifically affected post within the WordPress Gutenberg block editor - the script does not execute on the public-facing rendered page, significantly narrowing the viable victim pool. Sites that prohibit open contributor registration or that restrict the contributor role to fully trusted internal staff have a substantially reduced attack surface. The vulnerability is confined to installations running Smart Slider 3 versions 3.5.1.38 and below; sites running 3.5.1.39 or later, or not using the plugin, are not affected.

The CVSS 6.4 Medium score is well-calibrated for this vulnerability class: AV:N reflects web delivery, PR:L captures the contributor authentication prerequisite, and S:C accounts for the cross-session impact when a privileged user's browser executes the payload. The narrow execution context - scripts fire only when an Editor or Administrator opens the infected post inside the Gutenberg editor, not on the public-facing page - meaningfully constrains opportunistic exploitation and mass impact, meaning even a competent mid-sized IT team should treat this as a measured priority rather than an emergency. No KEV listing confirms active exploitation, no public exploit code has been identified, and no EPSS score was provided in the input data, leaving quantitative exploitation probability unconfirmed. The most credible threat scenario involves malicious or compromised contributor accounts as a lateral-movement vector toward higher-privilege account takeover, not broad public user compromise. Sites with open contributor registration or large contributor pools carry materially higher risk than those restricting contribution to vetted users.

An attacker holding contributor-level credentials on a WordPress site edits or creates a post and injects a JavaScript payload into the 'slider' Gutenberg block attribute, which is stored without sanitization. When a site Editor or Administrator later opens that post in the Gutenberg editor, the stored script executes silently in their privileged browser context, enabling the attacker to exfiltrate the admin's session cookies or nonces and subsequently perform authenticated actions - such as creating a new administrator account - without further interaction.