Executive brief
SliceWP is a WordPress plugin that extends WordPress site functionality. An unauthenticated attacker can inject malicious scripts into pages that are executed in the browsers of site visitors and administrators, potentially stealing login credentials, session tokens, or sensitive data. The vulnerability requires a victim to interact with a specially crafted link or page, but no authentication is needed for an attacker to set up the exploit.
Technical details
This vulnerability is a stored or reflected cross-site scripting (XSS) flaw in SliceWP versions 1.2.10 and earlier. The vulnerability arises from insufficient input validation or output encoding in the plugin, allowing an unauthenticated attacker to inject arbitrary JavaScript code. Successful exploitation requires user interaction (such as a visitor clicking a malicious link or an administrator visiting a crafted page). An attacker can steal session cookies, hijack accounts, redirect users to phishing pages, or perform actions on behalf of victims. The vulnerability has been patched in version 1.2.11 and later.
Affected products
- SliceWP SliceWP <=1.2.10
Timeline
- 2026-08-28: disclosed
- 2026-08-28: patched: version 1.2.11 released