Slim Jetpack (<= 2.7.0.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/slim-jetpack--2.7.0.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 10:42:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSlim Jetpack: Stored Cross-Site Scripting via contact form (CVE-2026-115498)https://feed.craftedsignal.io/briefs/2026-11-slim-jetpack-xss/Wed, 04 Nov 2026 10:42:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-slim-jetpack-xss/The Slim Jetpack WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the website contact-field parameter, enabling attackers to inject arbitrary web scripts through the [contact-form] shortcode.The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping. The vulnerability resides in the 'g<PAGE_ID>-website' parameter. Unauthenticated attackers can exploit this via the [contact-form] shortcode because nonce and authentication checks are only enforced for authenticated users, allowing guest submissions of malicious payloads.

Impact

Successful exploitation allows unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the browser of any user who accesses the page where the payload is stored.

Recommendation

  • Update the Slim Jetpack plugin to a version beyond 2.7.0.1 immediately.
  • Implement a Web Application Firewall (WAF) rule to inspect POST requests to the [contact-form] shortcode endpoints for script tags or common XSS patterns in the website URL/contact fields.
  • Review WordPress access logs for anomalous POST requests containing HTML or script tags directed at pages utilizing the Slim Jetpack [contact-form].
]]>highadvisoryxssweb-applicationwordpressplugin-vulnerability