CVE-2026-54867: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Griden Responsive Slider

CVE-2026-54867 describes a stored cross-site scripting vulnerability in the Griden Responsive Slider plugin (versions up to 0.1.9). The issue is due to improper neutralization of input during web page generation, which allows an attacker with limited privileges to inject malicious scripts that are stored and later executed in the context of users viewing the affected pages. This can lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).

Successful exploitation can result in stored XSS attacks, potentially allowing attackers to execute arbitrary scripts in the context of affected users. This can lead to information disclosure, modification of content, or disruption of availability. The vulnerability requires low attack complexity and privileges but user interaction is needed. The scope is changed, indicating impact beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting privileges of users who can submit input to the slider and apply web application firewall (WAF) rules to detect and block XSS payloads if possible.