Live › vulnerability › CVE-2026-115612
Go to dashboardSliceWP is a WordPress affiliate plugin, and versions through 1.2.13 let stored input be rendered as web page script without proper neutralization. An attacker who can store that input can run JavaScript in the browsers of people who view the affected page, such as site administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Sites running the SliceWP plugin at version 1.2.13 or earlier are affected. Sites that do not have SliceWP installed can skip it.
No product ranges from the sources yet.
wp plugin get slicewp --field=version1.2.13; anything at or below that is in the affected range1.2.13 once a patched release is published (unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Stored XSS.This issue affects SliceWP: from n/a through 1.2.13.
This page as .md · .json · in your agent: get_signal("CVE-2026-115612")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.