CVE-2026-115961: WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this vulnerability?

The CVSS vector indicates that an attacker needs low-level privileges (PR:L) and user interaction (UI:R). Exploitation is network-accessible (AV:N) and has low attack complexity (AC:L).

Q: Are installations using version 2.2.2 affected?

Yes. The affected range includes B Slider versions through 2.2.2; no fixed version is identified in the provided data.

Q: What is the likely impact if exploitation succeeds?

This is a stored XSS issue. The provided CVSS metrics indicate low confidentiality, integrity, and availability impact, with scope changed (S:C).

Published Oct 26, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows Stored XSS.This issue affects B Slider: from n/a through 2.2.2.

Affected Software

1 affected component

bPlugins B Slider<=2.2.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress B Slider to a version that resolves this vulnerability.
Fixed in 2.2.4

Event History

Oct 26, 2026

CVE Published

via MITRE·10:34 AM

Data Sourced

via MITRE·10:34 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

The CVSS vector indicates that an attacker needs low-level privileges (PR:L) and user interaction (UI:R). Exploitation is network-accessible (AV:N) and has low attack complexity (AC:L).

Are installations using version 2.2.2 affected?