株式会社mgn@mgn_jpn
🚨 Smart Slider 3 に脆弱性（深刻度 中） 80万サイト以上が利用 / CVSS 6.4 修正版 3.5.1.39 が公開済み https://shindan.m-g-n.me/alerts/cve-2026-14876/
00100439
315 followersView on X
CVE-2026-14876
LOWCVSS 6.4 · MEDIUMSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-79
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day
Deep dive
Activity timeline1 mentions / 1d
Referenced assets1 URL
By indicator