Content Slider Block EUVD-2026-110042

Exploitation requires an authenticated account with at least low-level content privileges (PR:L, e.g. contributor/author) able to add or configure a Content Slider Block and store a script payload, plus a victim with a higher-privileged session viewing that content (UI:R) for the stored script to fire. It is limited to Content Slider Block versions through 3.2.1 and depends on allowing untrusted users to author content; sites that restrict block editing to trusted administrators have a sharply reduced attack surface. The exact unsanitized field/attribute is not described in the available sources.

This is a moderate-severity stored XSS (CVSS 6.5) whose real-world urgency is tempered by its exploitation prerequisites rather than its CWE class. The CVSS vector reports network reach (AV:N) and low attack complexity (AC:L), but it also requires an authenticated account (PR:L) and victim user interaction (UI:R) - so this is not a drive-by, unauthenticated attack. The scope change (S:C) is the one aggravating signal: injected script executes in the browser context of whoever views the content (typically a higher-privileged editor or administrator), which is why the limited C:L/I:L/A:L impacts still matter. On the triage side, the vuln.today decision label is 'this_month' (not act_now or emergency), there is no CISA KEV listing, and no public exploit was identified. EPSS is absent from the input and cannot be cited; its absence is a data gap, not a low score. Net assessment: a genuine but routine WordPress-plugin XSS - worth patching on a normal monthly cadence rather than an emergency, with priority rising for sites that grant untrusted users contributor/author roles.

An attacker holding a low-privileged authenticated account (e.g. contributor or author) adds or edits a Content Slider Block and embeds a malicious script in a field that is not properly neutralized, persisting it in the site content. When an administrator or other user later views that content, the stored script runs in their browser session under the site origin. No public exploit code was identified; the specific injectable field is not described in the available sources.