CVE-2026-112845: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars)

The vulnerability CVE-2026-112845 affects the Off-Canvas Sidebars & Menus (Slidebars) product by Jory Hogeveen. It is caused by improper neutralization of input during web page generation, leading to a stored cross-site scripting (XSS) flaw. This allows attackers with limited privileges and requiring user interaction to inject malicious scripts that can impact confidentiality, integrity, and availability. The affected versions are from initial release up to but not including 0.5.9.1. There is no information on available patches or vendor advisories.

Successful exploitation of this stored XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system. Attackers may execute arbitrary scripts in the context of users interacting with the vulnerable component, potentially leading to session hijacking, data theft, or other malicious actions. The attack requires user interaction and privileges at least at the level of a limited user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider mitigating risk by restricting access to trusted users, sanitizing inputs where possible, or disabling the vulnerable component if feasible.