PT-2026-43623 · Averta+1 · Master Slider

Peter Thaleikis · CVE-2026-48968 · Published 2026-05-27 · Updated 2026-05-27

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Master Slider versions prior to 3.10.9

Description Insufficient input sanitization and output escaping lead to DOM-Based and Stored Cross-Site Scripting (XSS), a condition where malicious scripts are injected into web pages. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when a user accesses the affected page.

Recommendations Update to a version newer than 3.10.8.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-48968

Affected Products

Master Slider

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-48968 · Security Note
• https://patchstack.com/database/wordpress/plugin/master-slider/vulnerability/wordpress-master-slider-plugin-3-10-8-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0f17a161-83c8-4e83-a3e1-3e9f2e5f2c00?source=api-prod · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48968 · Note