What is the CVSS score of CVE-2026-57699?

CVE-2026-57699 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Slider Pro are affected by CVE-2026-57699?

bqworks Slider Pro versions 4.8.13 and earlier contain a cross-site scripting vulnerability that allows low-privileged WordPress users to inject malicious scripts affecting other site users and…

How to fix or mitigate CVE-2026-57699?

Immediately audit all WordPress installations to identify Slider Pro deployments and document their versions. Within seven days, either disable the plugin across all systems or implement restrictive Subscriber role capabilities to prevent unauthorized access to slider configuration and content creation functions. Over the next 30 days, establish monitoring of bqworks security advisories and the WordPress.org plugin repository for patch releases, and deploy the latest available version as soon as it becomes available while maintaining configuration backups.

Slider Pro CVE-2026-57699

EUVD-2026-48172 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-4v3w-x848-hh72

WordPress XSS Wordpress Plugin Slider Pro

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

'Subscriber' scope implies an authenticated low-privilege account (PR:L, not PR:N); UI:R because a victim must load the payload, S:C as script executes in the victim's browser context with Low impacts.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:20 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions.

AnalysisAI

Stored/reflected Cross-Site Scripting in the bqworks Slider Pro WordPress plugin (versions 4.8.13 and earlier) allows a low-privileged Subscriber-level user to inject malicious script that executes in another user's browser. The flaw was reported by Patchstack and carries a CVSS 7.1 driven by a scope change (S:C). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is unproven in the wild.

Technical ContextAI

The affected component is Slider Pro, a WordPress slider/gallery plugin published by bqworks (CPE cpe:2.3:a:bqworks:slider_pro). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is rendered into HTML output without adequate sanitization or output encoding. Because the label is 'Subscriber XSS,' the injection point is reachable by an authenticated low-privilege WordPress account, and the payload is later reflected or stored and served to other visitors or administrators, executing in the WordPress admin/front-end context. The CVSS scope change (S:C) reflects that the vulnerable component (the plugin) delivers script that impacts a separate security authority - the victim's browser session.

RemediationAI

Upgrade Slider Pro to the vendor's fixed release above 4.8.13 as soon as it is confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/sliderpro/vulnerability/wordpress-slider-pro-plugin-4-8-13-cross-site-scripting-xss-vulnerability); the released patched version is not independently confirmed from the provided data, so verify the exact version on the plugin changelog before deploying. If a patch is not yet available, apply compensating controls: restrict or disable self-registration and audit existing Subscriber accounts to limit who can reach the injection point (trade-off: breaks open-registration sites), and deploy a WordPress WAF/virtual patch (Patchstack, Wordfence) with XSS rules to filter malicious plugin input (trade-off: rule tuning may block legitimate slider content). A strict Content-Security-Policy that disallows inline script further reduces payload execution impact, at the cost of potentially breaking themes/plugins that rely on inline scripts.