What is the CVSS score of CVE-2026-56014?

CVE-2026-56014 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Master Slider are affected by CVE-2026-56014?

WordPress sites running Averta Master Slider plugin v3.11.2 and earlier contain an unpatched cross-site scripting vulnerability enabling unauthenticated session hijacking and account takeover.

How to fix or mitigate CVE-2026-56014?

Within 24 hours: Identify all WordPress installations using Averta Master Slider v3.11.2 or earlier; temporarily disable the plugin if operational requirements permit. Within 7 days: Deploy WAF XSS filtering and Content Security Policy headers; configure WordPress security plugins to monitor for exploitation indicators. Within 30 days: Subscribe to vendor security advisories for patch release; prepare upgrade to patched version when available; evaluate alternative slider plugins for future deployment.

Master Slider CVE-2026-56014

EUVD-2026-39377 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-25 Patchstack

GHSA-g89j-rqr8-pg94

WordPress XSS Master Slider Wordpress Plugin Averta

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-reachable unauthenticated XSS requiring victim interaction (UI:R) with browser-context scope change (S:C); Low confidentiality/integrity but no genuine availability impact, so A:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:22 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Master Slider <= 3.11.2 versions.

AnalysisAI

Stored or reflected cross-site scripting in the Averta Master Slider WordPress plugin (versions 3.11.2 and earlier) lets unauthenticated remote attackers inject script that executes in a victim's browser, but only after the victim interacts with attacker-supplied content (UI:R). The CVSS:3.1 vector's scope change (S:C) reflects that injected code runs in the browser's trust context rather than the plugin's, enabling session theft or actions on behalf of the victim. There is no public exploit identified at time of analysis and the issue is not on CISA KEV.

Technical ContextAI

Master Slider is a WordPress slider/carousel plugin published by Averta (CPE cpe:2.3:a:averta:master_slider). The flaw is classified CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is rendered back into HTML/JS output without proper output encoding or sanitization. Because the entry point is reachable without authentication, the unsanitized parameter is most likely a front-end request value or shortcode/slider attribute echoed into a page. The CVSS scope change indicates the injected payload executes in the browser security context of any user who renders the affected output.

RemediationAI

No vendor-released patch version is identified in the provided data; upgrade Master Slider to the first release published after 3.11.2 once confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/master-slider/vulnerability/wordpress-master-slider-plugin-3-11-2-cross-site-scripting-xss-vulnerability) or the plugin changelog. Until a fixed version is verified and applied, compensating controls include deploying a WordPress WAF or Patchstack virtual patch to filter XSS payloads against Master Slider endpoints, adding a restrictive Content-Security-Policy header to block inline/unauthorized script execution (trade-off: may break legitimate inline scripts and require tuning), and temporarily deactivating the plugin on high-risk public sites if slider functionality is non-essential (trade-off: removes the feature from affected pages).