{"id":"CVE-2026-116398","kind":"vulnerability","aliases":["CVE-2026-116398"],"related":[],"title":"Content Slider Block WordPress plugin: stored XSS through 3.2.1","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Content Slider Block content-slider-block allows Stored XSS.This issue affects Content Slider Block: from n/a through 3.2.1.","summary":"The bPlugins Content Slider Block WordPress plugin, versions through 3.2.1, fails to neutralize input when generating pages, which allows stored cross-site scripting. An attacker who can store content in the plugin can run script in the browser of later visitors, including administrators.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Content Slider Block plugin in the WordPress admin plugin list or in `wp-content/plugins/content-slider-block`.\n- Review the plugin's version header for `3.2.1` or lower.","fix":"- Update the Content Slider Block plugin to a version later than `3.2.1`; the fixed version is unknown from the sources.\n- Until patched, restrict who can add or edit slider content.","status":"open","published_at":"2026-10-26T18:17:44+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","triaged_at":"2026-10-26T18:33:57+00:00","updated_at":"2026-10-26T18:33:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T18:33:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Content Slider Block plugin to a version later than `3.2.1`; the fixed version is unknown from the sources.\n- Until patched, restrict who can add or edit slider content.","reach":"internet","title":"Content Slider Block WordPress plugin: stored XSS through 3.2.1","impact":"medium","summary":"The bPlugins Content Slider Block WordPress plugin, versions through 3.2.1, fails to neutralize input when generating pages, which allows stored cross-site scripting. An attacker who can store content in the plugin can run script in the browser of later visitors, including administrators.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' and admins' browsers","analyst_note":"Confirm the fixed plugin version and the minimum role needed to store the malicious input, using the NVD entry for CVE-2026-116398.","how_to_check":"- Check the installed version of the Content Slider Block plugin in the WordPress admin plugin list or in `wp-content/plugins/content-slider-block`.\n- Review the plugin's version header for `3.2.1` or lower.","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the bPlugins Content Slider Block plugin at version 3.2.1 or earlier are affected. Sites without this plugin installed can skip it. The sources do not say which roles can store the input, so the exposure for sites that limit editing to trusted users is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000626,"input_tokens":3312,"output_tokens":589,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116398':12A,15A '-2026':11A,14A '3.2.1':9A,30B,98C 'administr':64B 'affect':91C 'allow':39B,87C 'attack':46B 'block':3A,25B,82C,86C,94C 'bplugin':22B,79C 'browser':59B 'content':1A,23B,50B,80C,84C,92C 'content-slider-block':83C 'cross':42B,74C 'cross-sit':41B,73C 'cve':10A,13A 'fail':31B 'generat':36B,72C 'host':19B 'improp':65C 'includ':63B 'input':34B,68C 'issu':90C 'later':61B 'n/a':96C 'neutral':33B,66C 'packag':16B 'page':37B,71C 'plugin':5A,27B,53B 'run':55B 'script':44B,56B,76C 'self':18B 'self-host':17B 'site':43B,75C 'slider':2A,24B,81C,85C,93C 'store':6A,40B,49B,88C 'version':28B 'visitor':62B 'vulner':77C 'web':70C 'wordpress':4A,20B,26B 'xss':7A 'xss.this':89C","nicknames":[],"mitigations":[],"who_affected":"Sites running the bPlugins Content Slider Block plugin at version 3.2.1 or earlier are affected. Sites without this plugin installed can skip it. The sources do not say which roles can store the input, so the exposure for sites that limit editing to trusted users is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116398","severity":null,"published_at":"2026-10-26T18:17:44+00:00","modified_at":"2026-10-26T18:17:44+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","fetched_at":"2026-10-26T18:31:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}