CVE-2026-2282 is a stored cross-site scripting vulnerability in the Slidorion WordPress plugin (versions up to 1.0.2). It results from improper neutralization of input during web page generation (CWE-79). Authenticated administrators can inject arbitrary web scripts via the plugin's admin settings. This vulnerability manifests in multi-site WordPress environments or installations with disabled unfiltered_html capability. The injected scripts execute in the context of users visiting the affected pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 4.4, reflecting medium severity with network attack vector, high attack complexity, and no user interaction required.

An attacker with administrator-level permissions can inject persistent malicious scripts into pages generated by the Slidorion plugin. These scripts execute in the browsers of users who visit the affected pages, potentially compromising user sessions or performing unauthorized actions within the context of the site. The impact is limited by the requirement for high privileges (administrator) and the specific environment conditions (multi-site or disabled unfiltered_html). There is no indication of availability impact or known exploits in the wild.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict administrator access to trusted users only and consider disabling or removing the Slidorion plugin in multi-site environments or where unfiltered_html is disabled. Review and sanitize any admin settings input manually to prevent script injection. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.