Slider by 10Web CVE-2026-42711

Exploitation requires an attacker to deliver a crafted request/link to the vulnerable Slider by 10Web plugin (slider-wd) running version 1.2.63 or earlier on a WordPress site, and requires the victim to interact (UI:R) by loading that link in a browser. No authentication is needed (PR:N), so any unauthenticated attacker can originate the payload, but the dependency on victim interaction is the primary limiting factor - the flaw is not self-propagating and cannot be exploited without a human in the loop. The plugin must be installed and active for the vulnerable code path to be reachable.

CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - network-reachable, low complexity, no privileges required, but user interaction is mandatory and the impacts are only Low across confidentiality/integrity/availability with a scope change (typical of browser-context XSS). No EPSS score, KEV listing, or public POC is present in the supplied intelligence, so there is no evidence of active exploitation or automation; exploitation status is best characterized as no public exploit identified at time of analysis. The UI:R requirement means this is not a wormable, drive-by issue - it depends on luring a victim to load a crafted request/link - so despite the High CVSS this reads as a real-but-moderate priority rather than an emergency. The only source is a single Patchstack advisory; no independent 10Web vendor advisory or CISA corroboration was provided, so the version boundary (<= 1.2.63) and impact rest on Patchstack alone.

An attacker crafts a malicious link or request targeting the vulnerable Slider by 10Web parameter and tricks a victim (site visitor or administrator) into loading it. Because no authentication is required (PR:N) but user interaction is (UI:R), the injected script executes in the victim's browser in the site's context, enabling session/cookie theft or actions performed as the victim. No public proof-of-concept is referenced in the available data.