CVE-2026-76789

This vulnerability deserves more attention than its CVSS 8.8 score suggests. The critical factor is the execution context: the stored XSS in the slider plugin doesn't just run against administrators viewing the admin panel—it executes against every visitor who loads a page containing that slider. This transforms a routine plugin compromise into attack infrastructure. An attacker stores a payload once, and it silently distributes malware to every site visitor, repeatedly, for as long as the payload persists in settings. The technical root cause is straightforward: missing authorization check, missing nonce verification, and unescaped output in the AJAX handler that saves slider settings. This means the vulnerability is trivially exploitable without credentials—any visitor can send the request that stores malicious JavaScript. The lack of nonce validation also means the attack request can't be tied to a session for detection or rate-limiting. The EPSS score of 0.00186 likely understates actual risk because it measures current exploitation activity, not structural potential. Once this payload lands in database settings, it becomes persistent attack surface that no version bump removes. Sites that update to the patched version while retaining compromised settings remain weaponized—the 'patched' state applies to code, not data. Incident response must address both dimensions: apply the vendor patch to block new injections, then audit and clean stored settings to remove any payloads that predated the patch. Treat this as drive-by exploitation infrastructure, not merely admin panel compromise.

Reviewed through automated stages and approved by a human before publication.