EUVD-2026-89915
GHSA-3mp5-c386-59m5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft URL with malicious script in reflected parameter
-
DeliveryDeliver link via phishing or malicious page
-
ExploitVictim clicks and page reflects payload
-
ExecutionScript executes in victim browser under site origin
-
ImpactSteal session cookies or forge privileged actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to click an attacker-crafted URL (UI:R) targeting a vulnerable LayerSlider request parameter on a site running LayerSlider version 8.4.0 or earlier; the reflected value is returned in the HTTP response without proper output encoding. No authentication is needed by the attacker (PR:N), but exploitation is limited by the need for social engineering to induce the click and by the fact that impact is confined to the victim's browser session in the site origin - there is no direct server-side code execution. The specific vulnerable endpoint/parameter is not named in the advisory data, which limits precise detection and mitigation. |
| Impact | This is a moderate-severity reflected XSS (CWE-79) with CVSS 3.1 base 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The unauthenticated network vector (PR:N) and low complexity are the aggravating factors, but exploitation is gated on user interaction (UI:R) - a victim must click an attacker-crafted link - and the S:C scope change plus C/I/A:L reflect the bounded browser-context impact typical of reflected XSS, not server compromise. No EPSS score, KEV listing, POC, or SSVC data is provided in the input, so there is no signal of active or automated exploitation. The 7.1 is largely inflated by S:C (standard Patchstack scoring for XSS crossing the security boundary); real-world impact is limited to session/credential theft or action-forgery against whoever clicks the link. Net: a real but not urgent issue - patch in normal cadence rather than emergency. No conflicting signals were found; the CVSS vector is internally consistent with a reflected XSS. |
| Exploit ScenarioDerived | An attacker crafts a URL to a vulnerable LayerSlider endpoint that reflects an unsanitized parameter into the page, embedding a malicious script payload. They distribute the link via phishing email, forum post, or ad; when a logged-in WordPress user or site visitor clicks it, the script executes in their browser under the site's origin, enabling cookie/session theft or forged admin actions. No public exploit code is identified at time of analysis, and success depends on the victim clicking the crafted link. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Reflected cross-site scripting in the Kreatura LayerSlider WordPress plugin (versions through 8.4.0) allows an unauthenticated remote attacker to inject script into a page response by luring a victim to a crafted URL that carries malicious input in a plugin request parameter; the payload is reflected back without proper output encoding. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, exploitation does not require authentication on the attacker's side but does require victim interaction (a click on the attacker-supplied link), and impact is confined to the victim's browser session within the target site's origin rather than the server. There is no public exploit identified at time of analysis and no CISA KEV listing, and the plugin is widely deployed across WordPress sites, so the practical risk lies in mass opportunistic scanning and targeted phishing rather than confirmed active exploitation.
RemediationAI
No vendor-released patch version is confirmed in the supplied intelligence; only the Patchstack advisory is available (https://patchstack.com/database/wordpress/plugin/layerslider/vulnerability/wordpress-layerslider-plugin-8-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve), so the first action is to check Kreatura's LayerSlider release notes and WordPress plugin updates for any version above 8.4.0 and deploy it immediately if one exists, verifying by exact version number rather than assuming a fixed build is available. If no fixed release can be confirmed, compensating controls should be applied in order of effectiveness: deploy a WAF rule (e.g., a ModSecurity or managed WordPress WAF ruleset) that blocks script-bearing characters in query strings and POST parameters on LayerSlider routes, accepting that this is signature-based and may be bypassed by encoding tricks; add or enforce a Content-Security-Policy header that disallows inline script and restricts script-src to trusted origins, which materially reduces reflected XSS exploitation but can break themes and plugins that rely on inline JavaScript and must be rolled out in report-only mode first; and mark session cookies HttpOnly and SameSite=Lax/Strict to blunt script-based session theft, with the trade-off that some legitimate front-end integrations may lose cookie access. Where LayerSlider is not essential to the site, temporarily deactivating the plugin removes the attack surface entirely, at the cost of losing the slider functionality; more targeted but unreliable options include limiting exposure of front-end LayerSlider shortcode pages or filtering requests with suspicious query strings at the reverse proxy, which reduces but does not eliminate the reflection path. Finally, because the specific vulnerable parameter is unnamed, log analysis and virtual patching should monitor 4xx/5xx and reflected-parameter anomalies across all LayerSlider-related requests rather than a single known endpoint, and end users should be reminded that successful exploitation requires them to click an attacker-crafted link (UI:R), making user awareness and link-scanning controls a useful secondary layer.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the reflected XSS variant, occurring in the Kreatura LayerSlider WordPress plugin, identified by CPE cpe:2.3:a:kreatura:layerslider:*:*:*:*:*:*:*:* and tagged as a WordPress plugin issue by Patchstack. Reflected XSS arises when a PHP-handled request parameter is echoed into the HTML response during page generation without context-appropriate encoding or escaping, so attacker-controlled characters are parsed by the browser as markup or script rather than as inert text. The CVSS scope change (S:C) reflects that the injected script executes with the privileges of the hosting site's origin, giving it access to cookies not marked HttpOnly, session-bound nonces, and the ability to make authenticated same-origin requests on the victim's behalf - the classic pattern abused to hijack WordPress sessions or inject administrative actions. The underlying stack is standard WordPress/PHP: the plugin registers front-end routes and shortcode/asset handlers, and any of these that echo request-derived values without esc_attr(), esc_html(), or wp_kses() output escaping remain reachable by an unauthenticated visitor. Notably, the advisory does not name the specific vulnerable endpoint or parameter, which limits precise signature-based detection and confirms that the reflection surface was characterized only at the plugin level.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated remote reflected XSS requiring a victim click (UI:R); script executes in the site origin crossing the browser trust boundary (S:C) with limited C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS.
This issue affects LayerSlider: from n/a through 8.4.0.
Executive ViewAI
The Kreatura LayerSlider WordPress plugin (versions through 8.4.0) has a reflected cross-site scripting vulnerability that can let an unauthenticated attacker execute malicious script in a victim's browser when the victim clicks a crafted link. Because the plugin is widely deployed and no vendor-released patch has been identified, affected WordPress sites face elevated risk of opportunistic scanning, phishing, session theft, and reputational damage. There is no public exploit identified at time of analysis and no CISA KEV listing, but leadership should still prioritize inventory and mitigation across public-facing web properties.
Deactivate or remove the Kreatura LayerSlider plugin for versions through 8.4.0 where feasible; otherwise deploy WAF/virtual patching to block reflected XSS payloads in plugin parameters, enforce a restrictive Content Security Policy, conduct phishing awareness for users, monitor logs for crafted-link attempts, and track the vendor advisory for a fixed version.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB