Responsive Slider EUVD-2026-98298

Exploitation requires an authenticated account with at least low-level privileges sufficient to edit slider content in the Responsive Slider plugin (PR:L), and a victim must then view the page where the stored payload is rendered (UI:R) for the script to execute. Limiting factors: the attacker cannot act fully unauthenticated, the payload only triggers on victim page rendering rather than automatically, and impact is confined to browser-context script execution (Low C/I/A) rather than direct server compromise. The plugin must be installed and active on the target WordPress site, and the vulnerable slider output must be reachable by the targeted victim.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in the 'Responsive Slider' WordPress plugin by Griden, affecting versions up to and including 0.1.9. The Patchstack-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, 6.5 Medium) indicates network-reachable, low-complexity exploitation that nonetheless REQUIRES low-privilege authentication (PR:L) to inject the payload and REQUIRES victim interaction (UI:R) for the stored script to fire, with a scope change (S:C) reflecting execution in the victim's browser outside the vulnerable component's security boundary. Impacts are rated Low across confidentiality, integrity, and availability, consistent with typical XSS consequences rather than full system compromise. No EPSS score, CISA KEV entry, SSVC decision, or public POC was supplied in the input, so there is no signal of active or imminent exploitation; the only tag is 'XSS'. On balance this is a genuine but modest-priority issue: the authentication-plus-interaction requirement and Low impacts place it well below critical, and the absence of any exploitation evidence combined with a niche plugin argues for routine rather than emergency patching. No conflicting signals were observed, though the lack of EPSS/KEV/POC data means real-world exploitation likelihood is simply unknown rather than confirmed low.

A low-privileged authenticated user (e.g., a contributor or author able to configure the slider) injects a malicious script into a slider field that is stored and rendered without proper output encoding. When an administrator or other visitor subsequently views the page containing the slider, the stored script executes in their browser, potentially stealing session cookies or performing actions in their authenticated context. No public exploit code was identified in the provided data.