What is CVE-2026-18400?
CVE-2026-18400 is a Stored Cross-Site Scripting vulnerability in the MetaSlider plugin for WordPress (up to version 3.111.0) via the 'delay' Post Meta setting. It allows an authenticated attacker to inject malicious scripts executed in the browsers of site visitors. Updating the plugin to the latest version is recommended.
Azərbaycanca: CVE-2026-18400, WordPress üçün MetaSlider plaginində (3.111.0 və əvvəlki versiyalar) 'delay' Post Meta parametrində Stored Cross-Site Scripting zəifliyidir. Bu boşluq, autentifikasiya olunmuş hücumçuya zərərli skript yerləşdirərək sayt ziyarətçilərinin brauzerində işlətməyə imkan verir. Plagini ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-79
FAQ2
Which plugin and parameter are affected by CVE-2026-18400?
This vulnerability is found in the MetaSlider plugin for WordPress, specifically in the 'delay' Post Meta setting.
Does exploiting CVE-2026-18400 require authentication?
Yes, the vulnerability allows an authenticated attacker to inject malicious scripts.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.