CVE-2026-48968
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Averta Master Slider plugin in versions up to and including 3.10.8 contains an improper neutralization of input during web page generation vulnerability. This may lead to DOM-based cross-site scripting.
Risk Assessment
An attacker may inject malicious JavaScript that executes in the browser of a user visiting the page, potentially leading to data theft or session hijacking.
Recommendation
Update the Master Slider plugin to a version later than 3.10.8 once a fix is available, and consider validating input in slider templates.
Other vulnerabilities in Master Slider
See all- CVE-2026-56014High
Reflected XSS vulnerability in the Master Slider WordPress plugin, versions up to 3.11.5. Improper input neutralization during page generation allows reflected XSS attacks.
- CVE-2025-58025Medium
The Master Slider plugin contains a Stored XSS vulnerability in versions up to and including 3.11.0. An attacker can inject a malicious script that executes in the user's browser.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider allows DOM-Based XSS. This issue affects Master Slider: from n/a through 3.10.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS