# CVE-2026-15798: Smart Slider 3 stored cross-site scripting in slider block attribute

Source: https://junglewise.ai/threats/cve-2026-15798-smart-slider-3-stored-cross-site-scripting-in-slider-block  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-15798 · Severity: medium · CVSS 6.4 · Published 2026-08-28

Smart Slider 3 is a popular WordPress plugin used to create image sliders and carousels on websites. The plugin fails to properly sanitize user input in slider settings, allowing authenticated users with contributor access or higher to inject malicious scripts. When site editors or administrators view the affected content in WordPress's block editor, these scripts execute in their browser, potentially allowing attackers to steal credentials, modify page content, or perform administrative actions.

Technologies: [Nextend Smart Slider 3](https://junglewise.ai/threats/technologies/smart-slider-3). Vendors: [Nextend](https://junglewise.ai/threats/vendors/nextend).

## Quick answers

**Is CVE-2026-15798 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15798 being exploited in the wild.

**How severe is CVE-2026-15798?** Medium severity, with a CVSS score of 6.4, published 28 August 2026.

**Which products and versions are affected?** Nextend Smart Slider 3 up to and including 3.5.1.38.

**Is there a fix for CVE-2026-15798?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15798 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-15798?** Check whether you run Nextend Smart Slider 3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the Smart Slider 3 plugin's Gutenberg block implementation, specifically in the handling of the 'slider' block attribute. The plugin fails to sanitize input when processing slider configuration via the block editor and does not properly escape output, allowing authenticated attackers with contributor-level or higher permissions to inject arbitrary JavaScript. The attack is persistent (stored in the database) and executes whenever a user opens the affected post in the WordPress block editor, targeting Editors and Administrators who are more likely to review such content. No user interaction beyond opening the post editor is required from the victim. Patches are expected to be available through plugin updates.

## Affected products

- Nextend Smart Slider 3 up to and including 3.5.1.38

## Timeline

- 2026-08-28: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/smart-slider-3/tags/3.5.1.34/Nextend/SmartSlider3/Platform/WordPress/Integration/Gutenberg/Gutenberg.php](https://plugins.trac.wordpress.org/browser/smart-slider-3/tags/3.5.1.34/Nextend/SmartSlider3/Platform/WordPress/Integration/Gutenberg/Gutenberg.php)
- [https://plugins.trac.wordpress.org/browser/smart-slider-3/tags/3.5.1.34/Nextend/SmartSlider3/Platform/WordPress/Shortcode/Shortcode.php](https://plugins.trac.wordpress.org/browser/smart-slider-3/tags/3.5.1.34/Nextend/SmartSlider3/Platform/WordPress/Shortcode/Shortcode.php)

## Related threats

- [Nextend Smart Slider 3 directory traversal in replaceHTMLImage](https://junglewise.ai/threats/cve-2026-9197-nextend-smart-slider-3-directory-traversal-in-replacehtmlimage)