Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus… (CVE-2026-112845)

CVE-2026-112845 describes a stored cross-site scripting vulnerability in the Off-Canvas Sidebars & Menus (Slidebars) plugin by Jory Hogeveen. The flaw is due to improper neutralization of input during web page generation, which allows an attacker with limited privileges and requiring user interaction to inject and execute malicious scripts. The affected versions include all versions up to and including 0.5.9. The vulnerability has a CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, requiring privileges and user interaction, with impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to execute arbitrary scripts in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts. This could result in unauthorized actions performed on behalf of users or disclosure of sensitive information accessible to the affected users.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict privileges to trusted users and consider disabling or limiting use of the affected plugin to reduce exposure.