WordPress SliceWP plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

slicewp · Cross-site scripting · CWE-79

Affectedslicewp

FixUpdate to 1.2.7 or newer

PublishedJun 11, 21:07 · Patchstack

ScoredJun 11 · 7.1 · Patchstack

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:05 UTC

What we know

No known exploitation. CISA KEV, checked 22:05 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

Someone has to open, click or run something first. CVSS: user interaction required.

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.Mihai SliceWP allows Stored XSS. This issue affects SliceWP: from n/a through 1.2.6.

From Patchstack

Affected and fixed versions

ProductAffectedFixed inslicewpfrom n/a1.2.7

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

patchstack.com/database/wordpress/plugin/slicewp/vulnerability/wordpress-slicewp-plugin-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve · patchstack.comvdb entry

Other CVEs in slicewp

All 3 →

7.1WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability · CVE-2026-115612Oct 28 7.1WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability · CVE-2026-82224Aug 31 7.1WordPress SliceWP Affiliates plugin <= 1.1.18 - Reflected Cross Site Scripting (XSS) vulnerability · CVE-2024-47388Oct 5, 2024