Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

B Slider plugin can let attackers inject malicious code

CVE-2026-115961 · published 9 days ago
Summary

The B Slider add‑on for WordPress can store harmful script code that runs in a visitor's web browser. This lets a malicious user display unwanted content, steal information, or hijack user sessions on sites that use the plugin. Update the plugin to the newest release or disable/remove it to eliminate the risk.

What to do
  • Update bplugins b slider to version 2.2.4.
Affected software
VendorProductAffected versions
bplugins b slider <= 2.2.2
Fix: upgrade to 2.2.4
Original advisory text
WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows Stored XSS.This issue affects B Slider: from n/a through 2.2.2.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published26 Oct 2026
Updated27 Oct 2026
First seen26 Oct 2026
Sources
CVE-2026-115961 · NVD
CVE-2026-115961 · MITRE
Track software like this
Free during beta