CVE-2026-42700: WordPress Image Slider Widget plugin <= 1.1.130 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and user interaction. Exploitation is network-accessible and has low attack complexity.

Q: What is the potential impact if exploitation succeeds?

The issue is a stored XSS vulnerability, meaning malicious script can be retained and later executed when a user views affected content. The reported impacts include low confidentiality, integrity, and availability effects, with scope changed.

Q: Which plugin versions are affected?

Image Slider Widget versions through 1.1.130 are affected. The available data does not identify a fixed version.

Published Oct 5, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-slider-widget allows Stored XSS.This issue affects Image Slider Widget: from n/a through 1.1.130.

Affected Software

1 affected component

GhozyLab Image Slider Widget<=1.1.130

Event History

Oct 5, 2026

CVE Published

via MITRE·05:13 PM

Data Sourced

via MITRE·05:13 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and user interaction. Exploitation is network-accessible and has low attack complexity.

What is the potential impact if exploitation succeeds?

The issue is a stored XSS vulnerability, meaning malicious script can be retained and later executed when a user views affected content. The reported impacts include low confidentiality, integrity, and availability effects, with scope changed.

Which plugin versions are affected?