EUVD-2026-83660
GHSA-7q5g-f6v8-f8ch
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor account
-
DeliveryInsert ms_slider shortcode with malicious attribute
-
ExploitPublish/submit post for review
-
ExecutionHigher-privileged user views post
-
PersistScript executes in their session
-
ImpactHijack session or escalate privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with the Contributor role or higher on the target WordPress site, and requires the Master Slider plugin (≤3.11.2) to be installed and active. Exploitation is limited by needing victim user interaction (UI:R) - a higher-privileged user or visitor must view the post containing the malicious ms_slider shortcode for the payload to fire. There is no vendor patch, so the only mitigations are restricting Contributor accounts to trusted users, blocking the ms_slider shortcode for roles below Editor, or deactivating the plugin. Risk is amplified on multi-author sites where lower-trust users can submit content. |
| Impact | This is a stored XSS (CWE-79) in the Master Slider WordPress plugin (≤3.11.2) requiring an authenticated Contributor-or-above user, with victim interaction (viewing the affected post). Signals conflict on severity: WPScan's supplied vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H (6.8), but the C:H/I:H/A:H impact triad and PR:H are inconsistent with the described flaw - a Contributor-role XSS is a low-privilege actor (PR:L, not PR:H) and browser-context script execution normally maps to a scope change with limited C/I impact (S:C, C:L/I:L), not full host compromise. The description explicitly says 'Contributor role and above,' so PR:H overstates the barrier while C/I/A:H overstates impact; the net realistic score is moderate (~6.4). A public exploit exists (WPScan), but there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation. The practical risk is bounded by needing a trusted-tier account (Contributor) that can be abused by a malicious/compromised author, most impactful on multi-author sites. This is a genuine but moderate-priority issue - not a wormable unauthenticated RCE - and notably has NO fixed version, which raises operational urgency relative to a patchable bug. |
| Exploit ScenarioDerived | A malicious or compromised Contributor-level user embeds an ms_slider shortcode with a crafted attribute containing JavaScript that is emitted unescaped into an inline script context. When an editor, administrator, or site visitor views the post, the script executes in their browser session, enabling session/cookie theft, admin-action forgery, or account takeover. A public proof-of-concept is available via WPScan. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Stored cross-site scripting in the Master Slider WordPress plugin (versions through 3.11.2) lets an authenticated user with the Contributor role or higher inject script payloads via unsanitised shortcode attributes that are written into an inline script when a post is rendered. The payload fires only when a victim - a higher-privileged user or any site visitor - views the affected post, so exploitation hinges on a crafted post combined with victim interaction; publicly available exploit code exists, though there is no confirmed active exploitation (no CISA KEV listing) and no vendor-released patch. Because lower-trust accounts on multi-author sites can typically create posts containing the ms_slider shortcode, the practical risk is concentrated on sites that grant Contributor access to untrusted users.
RemediationAI
No vendor-released patch is identified at time of analysis, so remediation must be compensating controls. The most reliable option is to deactivate the Master Slider plugin entirely, since the vulnerable rendering path only exists while the plugin is active - the trade-off is loss of all slider functionality on the site. If the plugin must stay live, block the ms_slider shortcode for all roles below Editor using a shortcode-restriction plugin or a small role/capability filter, which prevents lower-trust users from planting a payload while leaving legitimate Editors able to build sliders; the caveat is that any Editor account then becomes the new abuse target and must be tightly controlled. A third option is to restrict the Contributor role to fully trusted users (or remove it, since Contributors can submit the offending shortcode), which reduces the multi-author attack surface but does not eliminate risk from compromised higher-privileged accounts and can disrupt legitimate editorial workflows. Where Contributors are still needed, require Editor review before publishing so that submitted shortcodes are not rendered on public posts - this adds editorial latency but keeps content authoring intact. Regardless of which control is chosen, review existing posts for any ms_slider shortcode with unusual attributes and remove or quarantine suspicious content, and consult the WPScan advisory at https://wpscan.com/vulnerability/06a5409c-3070-417f-98cb-0ca8ddbfe14c/ periodically to check whether a fixed plugin version has been released; once one ships, upgrade above 3.11.2 immediately.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-79 improper-neutralisation-of-input-during-web-page-generation flaw in the Master Slider WordPress plugin, which is distributed through the WordPress.org plugin repository (the CPE record cpe:2.3:a:unknown:master_slider:*:*:*:*:*:*:*:* reflects that no vendor namespace has been assigned). WordPress's shortcode API lets post authors embed plugin functionality by writing bracketed tags such as ms_slider into post content; the plugin processes those tags at render time and outputs some of their attribute values into an inline script block without escaping or contextual escaping appropriate for a JavaScript context. When an attribute value contains characters that terminate the surrounding script string or element, the injected markup is emitted verbatim into the page and executes in the origin of the affected site. Our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, i.e. an authenticated attacker holding at least the Contributor role (PR:L) with required victim interaction (UI:R) and a scope change (S:C) because the script runs in the site's page context against visitors and privileged users rather than within the plugin's own trust boundary. Impact is bounded to limited confidentiality and integrity loss (session/token theft, page defacement, actions performed as the viewing user) with no availability impact. Exploitability depends on the victim actually rendering the post that contains the malicious shortcode, which places the technique squarely in the stored-XSS class rather than a self-contained remote code execution path. The WPScan entry linked as an exploit reference and the ENISA EUVD record EUVD-2026-83660 document the same affected range (Master Slider 0 through 3.11.2).
Know when Master Slider gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor role is low-privilege (PR:L, not PR:H); stored XSS executes in a victim's browser after they view the post (UI:R, S:C) with limited confidentiality/integrity impact (C:L/I:L, A:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the affected post is viewed.
No fixed version is available. Until one ships, restrict the Contributor role to trusted users, or deactivate the Master Slider WordPress plugin through 3.11.2. Site owners who need to keep it active can block the ms_slider shortcode for roles below Editor, for example with a shortcode-restriction Master Slider WordPress plugin through 3.11.2, which prevents the attack without removing the Master Slider WordPress plugin through 3.11.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Master Slider
View allDuring testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an una
The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the M
The Master Slider - Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sl
Deserialization of Untrusted Data vulnerability in Averta Master Slider.9.5. Rated high severity (CVSS 8.3), this vulner
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Master slider Mast
The Master Slider WordPress plugin before 3.10.5 does not sanitise and escape some of its settings, which could allow hi
Stored or reflected cross-site scripting in the Averta Master Slider WordPress plugin (versions 3.11.2 and earlier) lets
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slid
The Master Slider - Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pl
The Master Slider - Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pl
The Master Slider - Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pl
The Master Slider - Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pl
Exploit-DB