Stored Cross-Site Scripting in Smart Slider 3 Plugin for WordPress

CVE-2026-15798

What is CVE-2026-15798?

The Smart Slider 3 plugin for WordPress has a vulnerability that allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts via the 'slider' Block Attribute. The lack of proper input sanitization and output escaping creates an avenue for potentially harmful scripts to be executed when affected pages are accessed in the WordPress block editor. This makes users with Editor and Administrator roles particularly vulnerable to attacks, as the injected scripts can compromise the security of the website, and user data can be at risk.

References