{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2282", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-10T14:21:28.511Z", "datePublished": "2026-02-19T04:36:11.156Z", "dateUpdated": "2026-04-08T16:52:19.907Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:19.907Z"}, "affected": [{"vendor": "hollandben", "product": "Slidorion", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Slidorion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "Slidorion <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Slidorion Settings", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/506a7351-07b9-4c0f-86c3-edfe04bac64c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/slidorion/trunk/slidorion.php#L212"}, {"url": "https://plugins.trac.wordpress.org/browser/slidorion/tags/1.0.2/slidorion.php#L212"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "san6051"}], "timeline": [{"time": "2026-02-18T15:53:42.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T17:03:49.892066Z", "id": "CVE-2026-2282", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:37:46.092Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2282", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T17:03:49.892066Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:03:51.716Z"}}], "cna": {"title": "Slidorion <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Slidorion Settings", "credits": [{"lang": "en", "type": "finder", "value": "san6051"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "hollandben", "product": "Slidorion", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-18T15:53:42.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/506a7351-07b9-4c0f-86c3-edfe04bac64c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/slidorion/trunk/slidorion.php#L212"}, {"url": "https://plugins.trac.wordpress.org/browser/slidorion/tags/1.0.2/slidorion.php#L212"}], "descriptions": [{"lang": "en", "value": "The Slidorion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-19T04:36:11.156Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2282", "state": "PUBLISHED", "dateUpdated": "2026-02-19T17:37:46.092Z", "dateReserved": "2026-02-10T14:21:28.511Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T04:36:11.156Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Slidorion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El plugin Slidorion para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de la configuraci\u00f3n de administrador en todas las versiones hasta la 1.0.2, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con permisos de nivel de administrador y superiores, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio y a instalaciones donde se ha deshabilitado unfiltered_html."}], "id": "CVE-2026-2282", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-02-19T07:17:46.230", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/slidorion/tags/1.0.2/slidorion.php#L212"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/slidorion/trunk/slidorion.php#L212"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/506a7351-07b9-4c0f-86c3-edfe04bac64c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Slidorion", "source": "cna", "vendor": "hollandben"}, "product": "slidorion", "vendor": "hollandben"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T18:11:46.208001+00:00", "value": {"mitigation_remediation": ["Update the Slidorion plugin to the latest version that removes the insufficient sanitization. ", "If an update is not immediately available, disable the Slidorion widget or remove the plugin entirely to eliminate the stored script vector. ", "Ensure that only trusted administrators have access and that unfiltered_html is not enabled; consider hardening role permissions and applying a Content Security Policy that blocks inline scripts."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting for privileged users"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the Slidorion plugin installed from the Hollandben development team, versions up to and including 1.0.2. The vulnerability affects multi\u2011site WordPress installations or any installation where the WordPress filter unfiltered_html has been disabled, allowing the malicious script to bypass default sanitization.", "description_and_impact": "The Slidorion plugin contains a stored cross\u2011site scripting flaw that allows an authenticated attacker with administrator\u2011level privileges to inject arbitrary scripts into the plugin\u2019s administrative settings. The injected code is stored and rendered on any page that displays a Slidorion\u2011controlled widget, causing it to execute in the browsers of all users who view the affected page. The impact includes the ability to deface the site, deliver phishing content, or serve malicious payloads, thereby compromising the integrity, confidentiality, and availability of user sessions. This weakness is a classic example of CWE\u201179, where insufficient input validation and output escaping create a persistent XSS vector.", "risk_and_exploitability": "The CVSS base score of 4.4 indicates a moderate severity, while the EPSS probability of less than 1% suggests that exploitation is currently rare but not impossible. The attacker must first authenticate to the WordPress dashboard with an account that has administrator or higher privileges, then navigate to the Slidorion settings page to inject the script. Because the vulnerability is only exploitable on sites without the unfiltered_html capability or on multi\u2011site configurations, the attack surface is relatively narrow, limiting widespread impact even if malicious actors are present."}}}}, "created": "2026-02-19T10:07:16.510279+00:00", "updated": "2026-04-15T18:15:10.846839+00:00", "vendors": ["hollandben", "hollandben$PRODUCT$slidorion", "wordpress", "wordpress$PRODUCT$wordpress"]}