CVE-2026-14876: fallo de gravedad media en nextendweb Smart Slider 3
Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block
Publicada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.4epss 0.2%
probabilidad de explotación
0.2%top 96% de las CVE
explotación observada
noninguna fuente lo reporta
The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Productos afectados
nextendweb · Smart Slider 3CVEs relacionadas — nextendweb Smart Slider 3
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-9197MEDIUMSmart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML ExportEPSS 0.8%CVE-2026-3098MEDIUMSmart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAllEPSS 0.4%CVE-2026-12385MEDIUMSmart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' ParameterEPSS 0.4%CVE-2025-6348MEDIUMSmart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` ParameterEPSS 0.4%CVE-2024-3027MEDIUMSmart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File UploadEPSS 0.3%CVE-2026-15798MEDIUMSmart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block AttributeEPSS 0.3%