What is the CVSS score of CVE-2026-57678?

CVE-2026-57678 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Slider Revolution are affected by CVE-2026-57678?

ThemePunch Slider Revolution, a widely deployed WordPress plugin, contains an unauthenticated reflected cross-site scripting vulnerability (CVSS 7.1) that allows remote attackers to compromise user…

How to fix or mitigate CVE-2026-57678?

Within 24 hours: Inventory all WordPress installations for Slider Revolution deployments and current versions. Within 7 days: Disable the plugin on non-critical sites; for business-critical deployments, implement Web Application Firewall rules blocking reflected XSS patterns and enforce Content Security Policy headers to restrict inline script execution. Within 30 days: Actively monitor ThemePunch vendor advisories for patch release; initiate migration evaluation to alternative slider plugins if no patched version is released within 30 days.

Slider Revolution CVE-2026-57678

EUVD-2026-41323 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 audit@patchstack.com

GHSA-9pp5-gx3c-vjc2

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-delivered reflected XSS needs no attacker auth (PR:N) but a victim click (UI:R); script runs cross-context (S:C) with limited C/I/A impact typical of XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:31 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePunch Slider Revolution allows Reflected XSS.

This issue affects Slider Revolution: from 7.0.0 through 7.0.16.

AnalysisAI

Reflected cross-site scripting in ThemePunch Slider Revolution (versions 7.0.0 through 7.0.16), a widely deployed premium WordPress slider/visual-builder plugin, lets a remote attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Because the CVSS scope is marked Changed with low impact across confidentiality, integrity, and availability, successful exploitation can lead to session hijacking, defacement, or actions performed in the victim's authenticated context. There is no public exploit identified at time of analysis and the flaw is not on CISA KEV, but the reflected nature and no-authentication requirement make it a practical phishing-driven threat.

Technical ContextAI

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controlled input is reflected back into an HTML response without proper output encoding or contextual sanitization. Slider Revolution (marketed as 'revslider') is a commercial WordPress plugin used to build sliders, carousels, hero blocks, and full page layouts; it exposes numerous admin and front-end request parameters that are echoed into generated pages. In a reflected XSS, one of these parameters is rendered into the page unescaped, so an attacker-supplied script payload in a request is returned and executed by the browser. The CVSS scope-change flag (S:C) reflects that the injected script executes in the security context of the WordPress site/browser session rather than the vulnerable component alone.

RemediationAI

Update Slider Revolution to a release newer than 7.0.16 (a version above the affected range published by ThemePunch/Patchstack); an exact patched version number was not provided in the input, so verify the current fixed release via the vendor and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/revslider/vulnerability/wordpress-slider-revolution-plugin-7-0-16-cross-site-scripting-xss-vulnerability before deploying. If an immediate update is not possible, apply a Web Application Firewall or virtual-patch rule (Patchstack and similar WAFs typically ship a signature for this CVE) to filter reflected script payloads on the vulnerable parameter, accepting the trade-off that WAF rules can be bypassed and may cause false positives on legitimate rich content. As additional compensating controls, restrict access to Slider Revolution admin endpoints to trusted IPs, enforce a strict Content-Security-Policy that disallows inline script to blunt payload execution (note this can break legitimate inline scripts on the site), and educate privileged users not to click untrusted links to the site.