CVE-2026-12385

MediumCVSS 4.3/10Last modified Jul 14, 2026

Description

The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract titles and full content excerpts of private, draft, pending, trashed, and auto-draft posts authored by any user, including Administrators and Editors. The required nonce is emitted on /wp-admin/post-new.php, which is accessible to Contributor-level users via the edit_posts capability, meaning any Contributor can obtain the nonce needed to trigger the injection.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jul 13, 2026
Last modified: Jul 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1238503.5In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives CVE-2026-1238515.4In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters CVE-2026-1238527.4In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates CVE-2026-1238537.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build CVE-2026-1238545.5In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module CVE-2026-1238557.5In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs CVE-2026-1238566.5In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server CVE-2026-1238574.3In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection CVE-2026-1238584.4In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects CVE-2026-1238598.1When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality in the Snowflake Con CVE-2026-123863.9Improper null termination vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Overflow Buffers. This CVE-2026-1238605.3Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allo