CVE-2026-42711— WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability
Quick assessment
Affected
10Web Slider by 10Web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 10Web 的 Slider 插件版本 <= 1.2.63 中存在未认证的跨站脚本（XSS）漏洞。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| 10Web | Slider by 10Web | n/a≤ 1.2.63 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-42711
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| 10Web | Slider by 10Web | n/a ~ 1.2.63 | - |
|
II. Public POCs for CVE-2026-42711
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42711
请登录查看更多情报信息。
Other References for CVE-2026-42711 (1)
Same Patch Batch · 10Web · 2026-10-10 · 5 CVEs total
| CVE-2026-105885 | 8.8 HIGH | WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability |
| CVE-2026-107742 | 7.2 HIGH | 10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author N |
| CVE-2026-42715 | 7.1 HIGH | WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerabili |
| CVE-2026-103998 | 6.1 MEDIUM | Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Arr |
IV. Related Vulnerabilities
Same product: Slider by 10Web
-
CVE-2026-105885
WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Inje -
CVE-2026-42710
WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection v -
CVE-2026-66635
WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Requ -
CVE-2024-10566
Slider by 10Web < 1.2.62 - Contributor+ Stored XSS -
CVE-2024-10565
Slider by 10Web < 1.2.62 - Admin+ Stored XSS via Widget
Same vendor: 10Web
-
CVE-2026-42715
WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Si -
CVE-2026-105885
WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Inje -
CVE-2026-107742
10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site -
CVE-2026-103998
Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Script -
CVE-2026-42710
WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection v
Same weakness: CWE-79
-
CVE-2026-57742
WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripti -
CVE-2026-78534
WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS -
CVE-2026-78532
WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vuln -
CVE-2026-62116
WordPress Barcode Scanner with Inventory & Order Manager plu -
CVE-2026-62100
WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scr
V. Comments for CVE-2026-42711
No comments yet