CVE-2026-42653: WordPress SliceWP plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Synopsis

Stored cross-site scripting (XSS) vulnerability in the SliceWP WordPress plugin (versions up to and including 1.2.6) allows an unauthenticated attacker to inject malicious scripts via the network that are then saved and later executed in the browsers of users who view the affected content. No authentication is required to submit the malicious payload, but a victim must load the affected page for the injected script to run. Successful exploitation gives the attacker the ability to read data from the victim's session, modify page content, and disrupt the user's experience within the affected application. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker submits the malicious payload over the network to the vulnerable WordPress installation, so the service must be reachable from the attacker's position.

• AuthenticationNot required

  No account or credentials are needed to inject the stored payload; the vulnerable input accepts unauthenticated submissions.

• Victim interactionRequired

  A logged-in or anonymous user must load the page containing the stored payload for the injected script to execute in their browser.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental preconditions.

Blast Radius

• An attacker's injected script runs in the victim's browser session, giving access to session cookies and authentication tokens for the affected WordPress site.
• Page content visible to the victim can be modified or replaced, enabling phishing lures or redirection to attacker-controlled sites.
• The injected script can perform actions on the WordPress site on behalf of the victim, including modifying settings or submitting forms, depending on the victim's privilege level.
• The script can interfere with page rendering and disrupt the user's interaction with the affected application.