Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anandaraj Balu Fade Slider fade-slider allows Reflected XSS.This issue affects Fade Slider: from n/a through <= 2.5.
Published: 2025-10-22
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Fade Slider plugin for WordPress contains a reflected XSS flaw caused by improper neutralization of input during web page generation. The plugin includes unescaped user input in the page output, which allows an attacker to inject arbitrary client‑side scripts.

Affected Systems

WordPress sites that have installed the Fade Slider plugin by Anandaraj Balu version 2.5 or earlier. The vulnerability applies to all releases from the original version through 2.5; sites should confirm whether the plugin is installed and running any of those versions.

Risk and Exploitability

The CVSS score of 7.1 indicates a high exploitation risk, while the EPSS score of less than 1% suggests that active exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by directing a user to visit a page that contains crafted input, as the flaw is remote and requires user interaction typical of reflected XSS scenarios.

Generated by OpenCVE AI on April 29, 2026 at 21:04 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Fade Slider plugin to a version newer than 2.5 or remove it if no update is available
  • If the plugin is no longer maintained, consider removing it entirely from the site
  • Ensure that any custom code that displays user input applies proper escaping, such as WordPress wp_kses functions to prevent unfiltered output

Generated by OpenCVE AI on April 29, 2026 at 21:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Title WordPress Fade Slider Plugin <= 2.5 - Cross Site Scripting (XSS) Vulnerability WordPress Fade Slider plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Thu, 13 Nov 2025 11:30:00 +0000

Type Values Removed Values Added
References

Thu, 13 Nov 2025 10:45:00 +0000

Type Values Removed Values Added
References

Thu, 23 Oct 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Thu, 23 Oct 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Oct 2025 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Wed, 22 Oct 2025 14:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anandaraj Balu Fade Slider fade-slider allows Reflected XSS.This issue affects Fade Slider: from n/a through <= 2.5.
Title WordPress Fade Slider Plugin <= 2.5 - Cross Site Scripting (XSS) Vulnerability
Weaknesses CWE-79
References

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T20:28:33.288Z

Reserved: 2025-06-11T16:07:34.181Z

Link: CVE-2025-49956

cve-icon Vulnrichment

Updated: 2025-10-23T14:24:05.778Z

cve-icon NVD

Status : Deferred

Published: 2025-10-22T15:15:42.140

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-49956

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T21:15:16Z

Weaknesses