Image Slider Widget EUVD-2026-92521

Requires an authenticated WordPress account with at least low-privilege content-submission capability (e.g., contributor/author) able to enter data into the Image Slider Widget plugin fields; the stored payload only fires when a victim - typically an administrator or editor - subsequently views the page rendering the attacker-controlled slider content. Limiting factors: authentication is mandatory (PR:L), victim interaction is required (UI:R, the victim must load the affected page), and exploitation depends on the vulnerable GhozyLab Image Slider Widget plugin (version n/a through 1.1.130) being installed and active; sites restricting untrusted users from content creation sharply reduce exposure.

This is a moderate-severity Stored XSS (CWE-79) with a CVSS 3.1 base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The vector indicates a network-reachable, low-complexity attack but requires an authenticated low-privileged account (PR:L) and victim interaction (UI:R), which materially reduces real-world urgency compared to an unauthenticated RCE. The scope change (S:C) reflects that injected script executes in another user's browser/session context - typically an administrator viewing attacker-supplied slider content - yielding only Low confidentiality, integrity, and availability impact. No EPSS score, CISA KEV listing, or POC/exploit reference is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only source is a Patchstack advisory. The signals are internally consistent (authenticated stored XSS in a WordPress plugin) with no conflict between the CVSS vector and the description. Net: a legitimate but not top-priority issue - patch in routine cycles, prioritized higher on multi-author WordPress sites where lower-trust users can submit content.

An attacker with a low-privileged authenticated WordPress account (e.g., contributor or author) injects a malicious script payload into an input field of the Image Slider Widget plugin (≤ 1.1.130). The payload is stored persistently and executes in the browser of an administrator or other user who later views the page containing the slider, enabling session/cookie theft or admin-context actions. No public exploit code is identified at time of analysis, so exploitation would require custom payload crafting.