CVE-2026-115612

HighCVSS 7.1

Published: 28/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Stored XSS. This issue affects SliceWP: from n/a through 1.2.13.

Risk Assessment

Stored XSS may allow an attacker to inject a malicious script that executes in a user's browser, potentially leading to session or data theft.

Recommendation

Update the SliceWP plugin to a version later than 1.2.13. Apply input validation and encoding in the application.

Other vulnerabilities in SliceWP

CVE-2026-82224High
An unauthenticated Cross Site Scripting (XSS) vulnerability in SliceWP versions up to and including 1.2.10.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Stored XSS.This issue affects SliceWP: from n/a through 1.2.13.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS