What is the CVSS score of CVE-2026-32494?

CVE-2026-32494 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Image Slider By Ays are affected by CVE-2026-32494?

CVE-2026-32494 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 7.1.

How to fix or mitigate CVE-2026-32494?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Image Slider By Ays CVE-2026-32494

EUVD-2026-15837 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 Patchstack

GHSA-68ph-vr74-q269

XSS Image Slider By Ays

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15837

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Image Slider by Ays ays-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Slider by Ays: from n/a through <= 2.7.1.

AnalysisAI

A Cross-site Scripting (XSS) vulnerability exists in the Ays Pro Image Slider WordPress plugin (versions up to and including 2.7.1) due to improper input neutralization during web page generation, combined with incorrectly configured access control security levels. Attackers can inject malicious scripts that execute in the context of other users' browsers, potentially stealing session tokens, redirecting users, or performing unauthorized actions on behalf of victims. No CVSS score, EPSS data, or active exploitation signals (KEV status) are currently available, but the vulnerability is confirmed by Patchstack and assigned EUVD-2026-15837.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic XSS flaw where user-supplied input is not properly sanitized or escaped before being rendered in HTML context. The affected product is the Ays Pro Image Slider plugin for WordPress (CPE: cpe:2.3:a:ays_pro:image_slider_by_ays), which generates dynamic web pages containing slider content. The root cause involves both insufficient input validation/output encoding AND weak access control mechanisms that allow attackers to inject malicious payloads (JavaScript, HTML) into pages viewed by other users. This is particularly critical in WordPress plugins because they have direct access to the database and page rendering pipeline.

RemediationAI

Immediately upgrade the Ays Pro Image Slider plugin to a version later than 2.7.1 (check the official WordPress plugin repository or vendor website for the latest patched release). Until a patch is available or deployed, implement input validation and output encoding at the application level by reviewing and restricting access to slider creation and configuration features to only trusted administrators, disable the plugin if not actively in use, and consider using a Web Application Firewall (WAF) to filter XSS payloads at the network edge. Additionally, regularly scan the WordPress installation for malicious scripts using security plugins (e.g., Wordfence, Sucuri) and audit user accounts for unauthorized modifications. For detailed guidance, refer to the Patchstack vulnerability report at https://patchstack.com/database/Wordpress/Plugin/ays-slider/vulnerability/wordpress-image-slider-by-ays-plugin-2-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve.