{"id":"CVE-2026-112845","kind":"vulnerability","aliases":["CVE-2026-112845"],"related":[],"title":"WordPress Off-Canvas Sidebars plugin: stored XSS through 0.5.9","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars allows Stored XSS.This issue affects Off-Canvas Sidebars & Menus (Slidebars): from n/a through 0.5.9.","summary":"The Off-Canvas Sidebars & Menus (Slidebars) WordPress plugin does not neutralize input when generating pages, so stored cross-site scripting is possible. An attacker who can save content that the plugin renders can run script in other visitors' browsers, including administrators.","severity":"medium","cvss":6.5,"epss":0.0013,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["off-canvas-sidebars","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-0.6-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/off-canvas-sidebars/` header\n- Confirm whether the plugin is active on the site","fix":"- Update Off-Canvas Sidebars & Menus (Slidebars) to a version newer than `0.5.9`; the sources do not name the fixed version, so unknown\n- If no fixed version is published, deactivate the plugin until it is","status":"open","published_at":"2026-10-22T09:17:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:47:29+00:00","updated_at":"2026-10-25T03:47:29+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:47:29Z","model":"claude-haiku-5-5","output":{"fix":"- Update Off-Canvas Sidebars & Menus (Slidebars) to a version newer than `0.5.9`; the sources do not name the fixed version, so unknown\n- If no fixed version is published, deactivate the plugin until it is","reach":"internet","title":"WordPress Off-Canvas Sidebars plugin: stored XSS through 0.5.9","impact":"medium","summary":"The Off-Canvas Sidebars & Menus (Slidebars) WordPress plugin does not neutralize input when generating pages, so stored cross-site scripting is possible. An attacker who can save content that the plugin renders can run script in other visitors' browsers, including administrators.","category":"package","nicknames":[],"who_cares":["wordpress","off-canvas-sidebars","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Script runs in visitors' browsers, possibly stealing admin sessions","analyst_note":"Confirm the fixed plugin version and the required privilege level from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112845 and the WordPress plugin changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/off-canvas-sidebars/` header\n- Confirm whether the plugin is active on the site","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-0.6-or-later"],"who_is_affected":"Sites running the Off-Canvas Sidebars & Menus (Slidebars) plugin at version 0.5.9 or earlier. Exposure depends on whether untrusted users can add content that the plugin outputs; sites where only trusted editors write content carry lower risk. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000677,"input_tokens":3395,"output_tokens":674,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112845':13A,16A '-2026':12A,15A '0.5.9':10A,109C 'administr':68B 'affect':99C 'allow':95C 'attack':51B 'browser':66B 'canva':4A,19B,29B,87C,93C,102C 'content':55B 'cross':45B,78C 'cross-sit':44B,77C 'cve':11A,14A 'generat':40B,76C 'hogeveen':84C 'host':24B 'improp':69C 'includ':67B 'input':38B,72C 'issu':98C 'jori':83C 'menus':31B,89C,104C 'n/a':107C 'neutral':37B,70C 'off-canva':2A,27B,85C,100C 'off-canvas-sidebar':17B,91C 'packag':21B 'page':41B,75C 'plugin':6A,34B,58B 'possibl':49B 'render':59B 'run':61B 'save':54B 'script':47B,62B,80C 'self':23B 'self-host':22B 'sidebar':5A,20B,30B,88C,94C,103C 'site':46B,79C 'slidebar':32B,90C,105C 'store':7A,43B,96C 'visitor':65B 'vulner':81C 'web':74C 'wordpress':1A,25B,33B 'xss':8A 'xss.this':97C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Off-Canvas Sidebars & Menus (Slidebars) plugin at version 0.5.9 or earlier. Exposure depends on whether untrusted users can add content that the plugin outputs; sites where only trusted editors write content carry lower risk. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112845","severity":null,"published_at":"2026-10-22T09:17:14+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112845","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112845","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}