CVE-2026-1634 describes a reflected cross-site scripting vulnerability in the Subitem AL Slider plugin for WordPress, affecting all versions up to and including 1.0.0. The issue stems from improper neutralization of input in the $_SERVER['PHP_SELF'] parameter, which is used in web page generation without adequate sanitization or escaping. This allows attackers to craft URLs that inject malicious scripts, potentially executing in the context of users who click the links. The vulnerability requires no privileges and user interaction is necessary. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user session data, perform actions on behalf of users, or conduct phishing attacks. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability affects unauthenticated users and requires user interaction to trigger.

No official patch or fix is currently available for this vulnerability. Users of the Subitem AL Slider plugin should monitor the vendor's communications for updates or patches. Until a fix is released, consider disabling the plugin or applying manual input sanitization and output escaping if feasible. Avoid clicking on suspicious links that may exploit this vulnerability.