CVE-2026-42711
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) vulnerability in the Slider by 10Web plugin in versions up to 1.2.63.
Risk Assessment
An unauthenticated attacker can inject malicious script that executes in the victim's browser, potentially leading to session theft or other attacks.
Recommendation
Update the Slider by 10Web plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Slider by 10Web
See all- CVE-2026-42710High
The Slider by 10Web (slider-wd) plugin contains a blind SQL injection vulnerability. The issue affects versions up to and including 1.2.63.
- CVE-2026-105885High
Slider by 10Web through version 1.2.62 contains a deserialization of untrusted data vulnerability that allows Object Injection. An attacker can exploit this to execute malicious code or manipulate application objects.
- CVE-2026-66635High
The Slider by 10Web plugin (versions up to 1.2.63) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick a logged-in user into performing unwanted actions within the application, such as changing slider settings.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS