{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aslim_jetpack_projectslim_jetpackwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:slim_jetpack_project:slim_jetpack:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-115498"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Slim Jetpack (\u003c= 2.7.0.1)"],"_cs_severities":["high"],"_cs_tags":["xss","web-application","wordpress","plugin-vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping. The vulnerability resides in the 'g\u0026lt;PAGE_ID\u0026gt;-website' parameter. Unauthenticated attackers can exploit this via the [contact-form] shortcode because nonce and authentication checks are only enforced for authenticated users, allowing guest submissions of malicious payloads.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the browser of any user who accesses the page where the payload is stored.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Slim Jetpack plugin to a version beyond 2.7.0.1 immediately.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) rule to inspect POST requests to the [contact-form] shortcode endpoints for script tags or common XSS patterns in the website URL/contact fields.\u003c/li\u003e\n\u003cli\u003eReview WordPress access logs for anomalous POST requests containing HTML or script tags directed at pages utilizing the Slim Jetpack [contact-form].\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T10:42:22Z","date_published":"2026-11-04T10:42:22Z","id":"https://feed.craftedsignal.io/briefs/2026-11-slim-jetpack-xss/","summary":"The Slim Jetpack WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the website contact-field parameter, enabling attackers to inject arbitrary web scripts through the [contact-form] shortcode.","title":"Slim Jetpack: Stored Cross-Site Scripting via contact form (CVE-2026-115498)","url":"https://feed.craftedsignal.io/briefs/2026-11-slim-jetpack-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:slim_jetpack_project:slim_jetpack:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}