Image Slider By Ays CVE-2026-32494

Requires victim to visit a web page containing the vulnerable Ays Pro Image Slider plugin (versions ≤2.7.1) with improper access control configuration. Attacker injects malicious scripts via slider input fields. Remote unauthenticated attacker; victim interaction (page visit) required.

While a CVSS vector and score are not yet assigned, the combination of factors suggests moderate-to-high real-world risk. The attack vector is likely network-based (XSS typically requires no special privileges or user interaction beyond visiting a compromised page), and WordPress plugins with XSS vulnerabilities are frequently targeted by automated scanners and exploit kits. The absence of a CVSS score and EPSS probability data limits quantitative risk scoring, but the confirmed CVE assignment, Patchstack report, and EUVD cataloging indicate this is a legitimate and validated vulnerability. Without information on POC availability or KEV inclusion, exploitation likelihood cannot be directly assessed, but XSS vulnerabilities in popular WordPress plugins are commonly exploited for website defacement, malware distribution, and account compromise. The access control misconfiguration component elevates risk by potentially allowing unauthenticated or low-privilege users to inject payloads. Organizations running Image Slider by Ays should prioritize patching over extended evaluation.

An attacker with access to create or edit image sliders (either as an authenticated low-privilege user exploiting the access control flaw or via an unauthenticated entry point) injects JavaScript code into a slider's title, description, or custom HTML field. When administrators or other website visitors view the slider on the front-end or admin pages, the malicious script executes in their browser context, allowing the attacker to steal admin session cookies, inject a malware redirect, or perform actions on behalf of the victim. Because XSS in WordPress admin pages is particularly damaging, an attacker could escalate privileges, create backdoor accounts, or deface the website entirely.