Off-Canvas Sidebars EUVD-2026-108058

Exploitation requires an authenticated WordPress account with at least low privileges (per PR:L) capable of reaching an input processed by the Off-Canvas Sidebars & Menus (Slidebars) plugin on versions up to and including 0.5.9, and requires a victim to subsequently view the page containing the stored payload (per UI:R). The exact plugin setting or field that accepts the unsanitized input is not described in the available sources. Limiting factors that reduce real-world risk: the need for valid authentication (not a default anonymous-unauthenticated flaw), the dependency on victim user interaction to render the stored payload, and a capped impact (Low confidentiality/integrity/availability) confined to browser-side script execution rather than direct server compromise.

This is a moderate-severity stored XSS (CVSS 6.5, CWE-79) with a mixed signal profile that places it below emergency priority. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity exploitation but with two meaningful brakes: PR:L requires an authenticated account and UI:R requires a victim to view the injected content; the scope change (S:C) and across-the-board Low impacts reflect script execution in a victim's browser rather than full server compromise. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a prioritized-but-not-urgent item. No EPSS score, no CISA KEV listing, and no PoC reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the only sourcing is a single Patchstack database advisory. Net assessment: a genuine issue worth patching on a normal cycle, not a drop-everything priority; the authentication and user-interaction requirements, plus the limited (Low) impact ceiling, keep real-world risk modest absent any exploitation-probability data.

An attacker holding a low-privileged authenticated WordPress account (for example a contributor- or author-level user) submits a crafted payload into an input handled by the Off-Canvas Sidebars & Menus plugin that is stored without proper neutralization. When an administrator or other user later views the affected page, the stored script executes in their browser session, enabling actions such as session/cookie theft or admin-context requests. No public exploit code is identified in the provided data, and the exact injectable field is not described in the available sources.