CVE-2026-15798
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slider' Block Attribute in all versions up to and including 3.5.1.38 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page. The scripts execute specifically when a user opens the affected post in the WordPress block editor, making Editors and Administrators the primary targets.
Risk Assessment
The risk involves potential session hijacking of editors and administrators, which could lead to full compromise of the WordPress site. Attackers can execute arbitrary scripts in the victim's browser context, potentially leading to data theft or malware distribution.
Recommendation
It is recommended to immediately update the Smart Slider 3 plugin to the latest version that includes the fix. Also, restrict user privileges to the minimum and regularly audit content for malicious code.
Other vulnerabilities in Smart Slider 3
See all- CVE-2026-12385Medium
The Smart Slider 3 plugin for WordPress up to version 3.5.1.37 inclusive is vulnerable to Sensitive Information Exposure via the 'keyword' parameter. This allows authenticated attackers with contributor-level access or higher to extract titles and full content excerpts of private, draft, pending, trashed, and auto-draft posts from any user, including Administrators and Editors.
- CVE-2026-9197Medium
The Smart Slider 3 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.1.36 via the replaceHTMLImage function. This allows authenticated attackers with administrator-level access or above to read the contents of arbitrary files on the server, which may contain sensitive information.
- CVE-2026-4065Medium
The Smart Slider 3 plugin for WordPress up to version 3.5.1.33 fails to check proper capabilities in multiple AJAX controller actions. Missing checkForCap() and validatePermission() calls allow authenticated attackers with Contributor-level access and above to enumerate slider metadata and create, modify, and delete image storage records.
Original NVD description (English source)
The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected scripts execute specifically when a user opens the affected post in the WordPress block editor, making Editors and Administrators the primary targets.