Description
Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.
Published: 2026-08-31
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an unauthenticated cross‑site scripting flaw in the SliceWP WordPress plugin up to version 1.2.10. It allows an attacker to inject arbitrary JavaScript that will execute in the browsers of visitors who access content from a site running the vulnerable plugin.

Affected Systems

WordPress sites that have the iova.mihai SliceWP plugin version 1.2.10 or earlier installed. No other products or vendor versions are listed.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity for this XSS flaw. Attackers do not need to authenticate to exploit it, and any user who views affected content can be impacted. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because of the high potential impact of arbitrary script execution, the risk is significant for WordPress sites that have the SliceWP plugin enabled.

Generated by OpenCVE AI on August 31, 2026 at 22:40 UTC.

Remediation

Vendor Solution

Update the WordPress SliceWP Plugin to the latest available version (at least 1.2.11).

OpenCVE Recommended Actions

  • Upgrade the SliceWP plugin to version 1.2.11 or later as released by iova.mihai.
  • If the plugin cannot be upgraded immediately, deactivate the SliceWP plugin to eliminate the vulnerability surface.
  • Implement a web application firewall or input filtering rule to block or escape JavaScript content before it is processed by the plugin.

Generated by OpenCVE AI on August 31, 2026 at 22:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Iova.mihai
Iova.mihai slicewp
Wordpress
Wordpress wordpress
Vendors & Products Iova.mihai
Iova.mihai slicewp
Wordpress
Wordpress wordpress

Mon, 31 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.
Title WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Iova.mihai Slicewp
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-31T20:30:53.635Z

Reserved: 2026-08-28T09:18:05.695Z

Link: CVE-2026-82224

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T21:17:53.193

Modified: 2026-08-31T21:17:53.193

Link: CVE-2026-82224

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T22:45:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')