CVE-2026-56014
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Reflected XSS vulnerability in the Master Slider WordPress plugin, versions up to 3.11.5. Improper input neutralization during page generation allows reflected XSS attacks.
Risk Assessment
An attacker can execute malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or content modification.
Recommendation
Update the Master Slider plugin to the latest patched version. Additionally, apply XSS filters at the application level.
Other vulnerabilities in Master Slider
See all- CVE-2026-48968Medium
The Averta Master Slider plugin in versions up to and including 3.10.8 contains an improper neutralization of input during web page generation vulnerability. This may lead to DOM-based cross-site scripting.
- CVE-2025-58025Medium
The Master Slider plugin contains a Stored XSS vulnerability in versions up to and including 3.11.0. An attacker can inject a malicious script that executes in the user's browser.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider master-slider allows Reflected XSS.This issue affects Master Slider: from n/a through 3.11.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS