What is the CVSS score of EUVD-2026-36932?

EUVD-2026-36932 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Responsive Slider MetaSlider are affected by EUVD-2026-36932?

The WordPress 'Responsive Slider by MetaSlider' plugin (versions ≤3.106.0) contains a critical remote code execution vulnerability exploitable by authenticated users with Editor-level privileges.

How to fix or mitigate EUVD-2026-36932?

Within 24 hours: Inventory all WordPress installations using MetaSlider; document affected versions; revoke or restrict Editor-level role assignments to essential personnel only; enable comprehensive audit logging. Within 7 days: Disable the Responsive Slider by MetaSlider plugin across all affected sites, or replace with a patched alternative (e.g., Elementor Slider, Smart Slider 3); review administrative logs for suspicious activity from Editor accounts. Within 30 days: Monitor vendor release notes and security advisories for patched versions ≥3.106.1; conduct application security training on least-privilege access; deploy Web Application Firewall rules to detect code injection patterns.

Responsive Slider MetaSlider EUVD-2026-36932

| CVE-2026-39465 CRITICAL

Code Injection (CWE-94)

2026-06-15 Patchstack

GHSA-86jj-298h-3x24

Code Injection RCE Responsive Slider By Metaslider

9.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Reachable over the network via wp-admin (AV:N/AC:L), requires Editor role (PR:H), no user interaction, and code execution from a plugin context affects the wider WordPress host (S:C, C/I/A:H).

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:31 vuln.today

DescriptionCVE.org

Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.

AnalysisAI

Remote code execution in the WordPress 'Responsive Slider by MetaSlider' plugin (versions ≤3.106.0) allows authenticated users with Editor-level privileges to inject and execute arbitrary code on the underlying server. The flaw is tracked as CWE-94 (Improper Control of Generation of Code) and carries a CVSS 3.1 score of 9.1 because exploitation crosses a scope boundary, but no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is the 'ml-slider' WordPress plugin distributed as 'Responsive Slider by MetaSlider' (CPE cpe:2.3:a:metaslider:responsive_slider_by_metaslider). CWE-94 indicates the plugin processes attacker-controlled input that ends up evaluated as PHP code or otherwise dispatched to a code execution sink, rather than treated strictly as data. Because WordPress Editors can manage plugin-driven content such as slides, captions, shortcodes, and embedded HTML, a code-injection sink reachable from an Editor-facing endpoint is sufficient to reach the PHP runtime hosting the site.

RemediationAI

Upgrade the 'Responsive Slider by MetaSlider' plugin to the first release above 3.106.0 published on the WordPress plugin repository; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ml-slider/vulnerability/wordpress-responsive-slider-by-metaslider-plugin-3-106-0-remote-code-execution-rce-vulnerability) should be consulted for the exact fixed version once listed. Patch available per vendor advisory but no exact fixed version is supplied in the input, so administrators should verify the installed version is strictly greater than 3.106.0. As compensating controls until the upgrade lands, demote untrusted Editor accounts to Author or Contributor (Editors are the minimum role that can trigger the bug), enforce MFA on all Editor/Admin logins to reduce credential-theft risk, deploy the Patchstack or equivalent vPatch/WAF rule that virtually patches MetaSlider, and temporarily deactivate the plugin if slider functionality is non-essential - note that deactivation will break any front-end pages embedding MetaSlider shortcodes.