{"id":"CVE-2026-115612","kind":"vulnerability","aliases":["CVE-2026-115612"],"related":[],"title":"SliceWP affiliate plugin: stored XSS through version 1.2.13","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Stored XSS.This issue affects SliceWP: from n/a through 1.2.13.","summary":"SliceWP is a WordPress affiliate plugin, and versions through 1.2.13 let stored input be rendered as web page script without proper neutralization. An attacker who can store that input can run JavaScript in the browsers of people who view the affected page, such as site administrators.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","slicewp","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed SliceWP version in the WordPress plugins screen or `wp plugin get slicewp --field=version`\n- Compare the result against `1.2.13`; anything at or below that is in the affected range","fix":"- Update SliceWP to a version later than `1.2.13` once a patched release is published (unknown from the sources)\n- Until then, restrict who can enter affiliate or referral data in the plugin (unknown from the sources)","status":"open","published_at":"2026-10-28T13:17:05+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:34:11+00:00","updated_at":"2026-10-28T13:34:11+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T13:34:11Z","model":"claude-haiku-5-5","output":{"fix":"- Update SliceWP to a version later than `1.2.13` once a patched release is published (unknown from the sources)\n- Until then, restrict who can enter affiliate or referral data in the plugin (unknown from the sources)","reach":"internet","title":"SliceWP affiliate plugin: stored XSS through version 1.2.13","impact":"medium","summary":"SliceWP is a WordPress affiliate plugin, and versions through 1.2.13 let stored input be rendered as web page script without proper neutralization. An attacker who can store that input can run JavaScript in the browsers of people who view the affected page, such as site administrators.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","slicewp","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker script runs in admin browsers, enabling account takeover","analyst_note":"Confirm the patched SliceWP version and which input fields and roles are involved, from the NVD entry or the plugin vendor advisory.","how_to_check":"- Check the installed SliceWP version in the WordPress plugins screen or `wp plugin get slicewp --field=version`\n- Compare the result against `1.2.13`; anything at or below that is in the affected range","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the SliceWP plugin at version 1.2.13 or earlier are affected. Sites that do not have SliceWP installed can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000611,"input_tokens":3307,"output_tokens":561,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115612':11A,14A '-2026':10A,13A '1.2.13':8A,33B,96C 'administr':69B 'affect':64B,91C 'affili':2A,28B 'allow':87C 'attack':47B 'browser':58B 'cross':79C 'cross-sit':78C 'cve':9A,12A 'generat':77C 'host':18B 'improp':70C 'input':36B,52B,73C 'iova.mihai':84C 'issu':90C 'javascript':55B 'let':34B 'n/a':94C 'neutral':45B,71C 'packag':15B 'page':41B,65B,76C 'peopl':60B 'plugin':3A,23B,29B 'proper':44B 'render':38B 'run':54B 'script':42B,81C 'self':17B 'self-host':16B 'site':68B,80C 'slicewp':1A,19B,24B,85C,86C,92C 'store':4A,35B,50B,88C 'version':7A,31B 'view':62B 'vulner':82C 'web':40B,75C 'without':43B 'wordpress':20B,22B,27B 'wordpress-plugin':21B 'xss':5A 'xss.this':89C","nicknames":[],"mitigations":[],"who_affected":"Sites running the SliceWP plugin at version 1.2.13 or earlier are affected. Sites that do not have SliceWP installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115612","severity":null,"published_at":"2026-10-28T13:17:05+00:00","modified_at":"2026-10-28T13:17:05+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}