CVE-2026-57678
HighCVSS 7.1Summary
The Slider Revolution plugin versions 7.0.0 through 7.0.16 contain a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script into an HTTP request that will be executed in the victim's browser.
Risk Assessment
The risk includes potential session hijacking, redirection to malicious sites, or other actions performed within the victim's session context, which could lead to data confidentiality and system integrity breaches.
Recommendation
It is recommended to immediately update the Slider Revolution plugin to a version later than 7.0.16 that includes the fix. Additionally, consider deploying Web Application Firewalls (WAF) to block common XSS attack patterns.
Other vulnerabilities in Slider Revolution
See all- CVE-2026-7542Medium
The Slider Revolution plugin for WordPress versions 7.0 to 7.0.10 allows sensitive information disclosure. Authenticated attackers with Subscriber-level access can read server files (e.g., .sql, .log, .json) by copying them to a publicly accessible directory.
- CVE-2026-9050Medium
The Slider Revolution plugin for WordPress versions 6.0.0-6.7.55 and 7.0.0-7.0.14 is vulnerable to unauthorized data modification. Lack of permission verification allows authenticated attackers with Contributor-level access or higher to deactivate any active plugin on the site.
- CVE-2026-9048Medium
The Slider Revolution plugin for WordPress versions 7.0.0 – 7.0.14 exposes sensitive data via the 'slider.get.full' AJAX action. Authenticated attackers with Contributor-level access or higher can extract raw social media API credentials, including Instagram OAuth token, Flickr API key, YouTube Data API key, and Facebook App ID.
- CVE-2026-6728Medium
The Slider Revolution plugin for WordPress up to version 7.0.9 has a sensitive information exposure vulnerability via the 'get_stream_data()' function. Unauthenticated attackers can extract data including password-protected post, page, and product content.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePunch Slider Revolution allows Reflected XSS. This issue affects Slider Revolution: from 7.0.0 through 7.0.16.