CVE-2026-15798: Smart Slider 3 WordPress XSS Vulnerability

CVE-2026-15798 Overview

CVE-2026-15798 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Smart Slider 3 plugin for WordPress. The flaw affects all versions up to and including 3.5.1.38 and stems from insufficient input sanitization and output escaping on the slider Block Attribute. Authenticated users with contributor-level access or above can inject arbitrary JavaScript into pages. The injected scripts execute when a higher-privileged user opens the affected post in the WordPress block editor, making Editors and Administrators the primary targets. Successful exploitation can lead to session theft, account takeover, or unauthorized administrative actions within WordPress.

Critical Impact
A contributor-level attacker can hijack Editor or Administrator sessions by injecting malicious scripts that execute inside the Gutenberg block editor.

Affected Products

Smart Slider 3 plugin for WordPress — all versions up to and including 3.5.1.38
WordPress sites using the Gutenberg block editor with Smart Slider 3 installed
Fixed in Smart Slider 3 version 3.5.1.39

Discovery Timeline

2026-08-28 - CVE-2026-15798 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-15798

Vulnerability Analysis

Smart Slider 3 registers a Gutenberg block that stores a slider attribute controlling which slider is rendered when a post is edited or viewed. The plugin fails to properly sanitize this attribute on input and does not escape it on output when the block is rendered inside the WordPress block editor. As a result, an attacker can craft a block payload whose slider attribute contains JavaScript that is later interpreted by the browser.

Because the payload is stored in post content, the attack is persistent. When any user with permission to edit the affected post opens it in Gutenberg, the malicious script executes in that user's authenticated session. This allows the attacker to leverage the higher-privileged victim's context to modify content, create administrator accounts, install plugins, or exfiltrate cookies.

Root Cause

The root cause is missing input sanitization and output escaping around the slider block attribute in the plugin's Gutenberg integration. Relevant plugin logic lives in Nextend/SmartSlider3/Platform/WordPress/Integration/Gutenberg/Gutenberg.php, Nextend/SmartSlider3/Platform/WordPress/Shortcode/Shortcode.php, and the client-side Public/SmartSlider3/Platform/WordPress/Integration/Gutenberg/Assets/dist/gutenberg-block.js. Untrusted attribute data flows into the block editor render path without being passed through esc_attr(), wp_kses(), or an equivalent escape function.

Attack Vector

Exploitation requires an authenticated contributor account, which is a low bar on sites that allow user registration or third-party content submission. The attacker creates or edits a post, inserts a Smart Slider 3 block, and manipulates the slider attribute to include a script payload. The attacker submits the post for review or otherwise ensures an Editor or Administrator opens it in the block editor. On open, the injected script executes with the victim's privileges. Because the scope is Changed (S:C), the impact crosses trust boundaries from the contributor's authored content to higher-privileged administrative sessions.

See the Wordfence Vulnerability Report and the WordPress Changeset for gutenberg-block.js for technical details.

Detection Methods for CVE-2026-15798

Indicators of Compromise

Smart Slider 3 blocks in post content whose slider attribute contains HTML tags, angle brackets, javascript: URIs, or event handler substrings such as onerror= or onclick=.
Unexpected WordPress administrator accounts, plugin installations, or option changes created shortly after an Editor or Administrator opened a contributor-submitted post.
Outbound HTTP requests from an administrator's browser to attacker-controlled domains while editing posts.

Detection Strategies

Query the wp_posts table for post_content matching the Smart Slider 3 block pattern with suspicious characters in the slider attribute value.
Enable WordPress audit logging to correlate post edits by contributor accounts with subsequent privileged actions performed by Editors or Administrators.
Deploy web application firewall rules that inspect POST bodies to wp-admin/post.php for script payloads inside Gutenberg block attributes.

Monitoring Recommendations

Monitor creation of new users with administrator role, plugin installations, and changes to siteurl or home options.
Alert on Content Security Policy violations reported by the WordPress admin origin.
Track the installed Smart Slider 3 version across managed WordPress fleets and flag any host running 3.5.1.38 or earlier.

How to Mitigate CVE-2026-15798

Immediate Actions Required

Upgrade Smart Slider 3 to version 3.5.1.39 or later on every WordPress site where the plugin is installed.
Audit existing contributor and author accounts, remove unused ones, and rotate credentials for any account showing suspicious post activity.
Review recent posts and pages containing Smart Slider 3 blocks for malicious slider attribute values before opening them in the block editor.

Patch Information

The issue is resolved in Smart Slider 3 3.5.1.39. Review the version diff from 3.5.1.38 to 3.5.1.39 and the gutenberg-block.js changeset for the exact code changes.

Workarounds

Restrict the ability to submit or edit posts to trusted users until the plugin can be updated.
Deactivate the Smart Slider 3 plugin on sites that cannot be patched immediately.
Deploy a strict Content Security Policy on /wp-admin/ that disallows inline scripts and unknown script sources to reduce XSS impact.

bash

# Update Smart Slider 3 via WP-CLI
wp plugin update smart-slider-3 --version=3.5.1.39
wp plugin get smart-slider-3 --field=version