---
id: "CVE-2026-115612"
kind: "vulnerability"
aliases: ["CVE-2026-115612"]
title: "SliceWP affiliate plugin: stored XSS through version 1.2.13"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "slicewp", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-28T13:17:05+00:00"
first_seen_at: "2026-10-28T13:33:01+00:00"
updated_at: "2026-10-28T13:34:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115612", "first_seen_at": "2026-10-28T13:33:01+00:00"}]
---

# SliceWP affiliate plugin: stored XSS through version 1.2.13

SliceWP is a WordPress affiliate plugin, and versions through 1.2.13 let stored input be rendered as web page script without proper neutralization. An attacker who can store that input can run JavaScript in the browsers of people who view the affected page, such as site administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SliceWP version in the WordPress plugins screen or `wp plugin get slicewp --field=version`
- Compare the result against `1.2.13`; anything at or below that is in the affected range

## Fix

- Update SliceWP to a version later than `1.2.13` once a patched release is published (unknown from the sources)
- Until then, restrict who can enter affiliate or referral data in the plugin (unknown from the sources)

## Timeline

- 2026-10-28T13:33:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115612

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Stored XSS.This issue affects SliceWP: from n/a through 1.2.13.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_