CVE-2026-3004 is a stored cross-site scripting vulnerability in the Snow Monkey Blocks plugin for WordPress, specifically in the ‘data-slick’ attribute. This vulnerability allows authenticated users with Contributor-level permissions or above to inject arbitrary JavaScript code into pages. The root cause is insufficient sanitization and escaping of user input before outputting it in the web page. The vulnerability affects all versions up to and including 24.1.11. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required at the contributor level, no user interaction, and impacts on confidentiality and integrity with no availability impact. No official fix or patch has been confirmed at this time.

An attacker with Contributor-level or higher access can exploit this vulnerability to inject malicious scripts that execute in the context of users viewing the infected pages. This can lead to unauthorized actions such as session hijacking or data theft limited to the confidentiality and integrity of affected users. There is no impact on system availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Contributor-level access to trusted users and consider additional input validation or output escaping controls if possible. Monitor vendor channels for updates regarding patches or official mitigations.