PT-2026-52428 · WordPress · Master Slider

João Pedro S Alcântara + 1 · CVE-2026-56014 · Published 2026-06-25 · Updated 2026-06-26

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Master Slider versions prior to 3.11.3

Description An unauthenticated cross-site scripting (XSS) flaw exists in the web-facing input handling. The issue stems from improper input validation and output encoding, which allows attacker-supplied content to be rendered as an active script in the browser. A remote attacker can inject malicious payloads into exposed parameters or fields without authentication. If an administrator or user interacts with the crafted content, it can lead to session hijacking, admin account takeover via stolen cookies or nonces, and malicious redirects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-56014

Affected Products

Master Slider

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-56014 · Security Note
• https://twitter.com/UpwindMDR/status/2070200195174879281 · Twitter Post
• https://twitter.com/UpwindMDR/status/2070199906078200065 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/master-slider/vulnerability/wordpress-master-slider-plugin-3-11-2-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://t.me/cveNotify/176447 · Telegram Post
• https://reddit.com/r/StopBadBots/comments/1ufl33j/critical_security_alert_unpatched_plugins_listed · Reddit Post