Description

Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-31T21:17:53.193Z",
  "pubdate": "2026-08-31T21:17:53.193Z",
  "executiveSummary": "SliceWP versions 1.2.10 and earlier are vulnerable to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability. This security flaw allows remote, unauthenticated attackers to inject malicious JavaScript into the web browser of an unsuspecting user by enticing them to interact with a crafted URL.\nThe vulnerability exists due to improper neutralization of user-supplied input before rendering it in the application's response. Successful exploitation permits the execution of arbitrary scripts within the context of the victim's session, which may lead to session hijacking, unauthorized actions on behalf of the user, sensitive data exfiltration, or the redirection of users to malicious websites.\nBecause the vulnerability is exploitable without authentication, it presents a significant risk to the security of administrators or end-users interacting with the plugin. There are no specific complex requirements for exploitation other than the ability to deliver a crafted URL to the target, making it a viable vector for phishing or social engineering campaigns. The impact is primarily client-side; however, if an administrator falls victim to the attack, the repercussions can extend to full site compromise through unauthorized administrative actions.",
  "technicalDetails": "The vulnerability stems from an insufficient sanitization or validation process regarding query parameters or URL-based inputs processed by the SliceWP plugin. When the plugin handles these parameters, it fails to encode the output correctly before reflecting it back to the client browser.\nThe root cause is the inclusion of unfiltered input into the document object model (DOM) of the rendered page. An attacker can craft a URL containing malicious script tags or event handlers (e.g., onerror, onload) within the vulnerable parameter. When a victim accesses this crafted URL, the server-side logic processes the request and embeds the attacker-supplied payload directly into the HTML source code.\nAttack flow: 1. The attacker identifies the vulnerable parameter that reflects input to the page. 2. The attacker constructs a payload consisting of JavaScript code encapsulated in tags or attribute-based execution vectors. 3. The attacker hosts or sends a link containing the payload to the victim. 4. Upon clicking the link, the victim's browser sends the request to the SliceWP-enabled server. 5. The server responds with the payload embedded in the HTML response. 6. The victim's browser parses the malicious payload, executing the script in the context of the vulnerable origin.\nThis vulnerability is classified as Reflected XSS, specifically requiring the interaction of a victim to trigger the execution. Because the input is rendered without proper escaping (e.g., using esc_html() or esc_attr() in WordPress), the browser interprets the payload as legitimate script or HTML content. The lack of authentication requirements means that any network-adjacent attacker can initiate this attack, provided they can reach the target application endpoint. Post-exploitation, the malicious script can access Document cookies (if the HttpOnly flag is missing), intercept user input, perform asynchronous requests to other endpoints on behalf of the authenticated user, or modify the visual appearance of the page to perform credential harvesting."
}