SECURITYHIGHCVE-2026-115498

CVE-2026-115498: Slim Jetpack WordPress Plugin Unauthenticated Stored XSS

The Slim Jetpack plugin for WordPress through 2.7.0.1 allows unauthenticated stored cross-site scripting via a contact-field parameter (CVSS 7.2).

Dylan H.

Security Team

November 5, 2026
2 min read
CVE-2026-115498: Slim Jetpack WordPress Plugin Unauthenticated Stored XSS

Affected Products

  • Slim Jetpack plugin for WordPress, versions 2.7.0.1 and earlier

Overview

CVE-2026-115498 is a stored cross-site scripting (XSS) vulnerability in the Slim Jetpack plugin for WordPress, published to the NVD on November 4, 2026 with a CVSS score of 7.2 (High). All versions up to and including 2.7.0.1 are affected.

Technical Details

The flaw is caused by insufficient input sanitization and output escaping on a parameter of the form g<PAGE_ID>-website (the website contact field). An unauthenticated attacker can submit a crafted value that is stored and later executes in the browser of any user who views the affected page, including site administrators.

Impact

  • Execution of attacker-controlled JavaScript in the context of the victim's session
  • Potential session theft, admin account actions, malicious redirects or content injection
  • Persistence, since the payload is stored in the site's data

Remediation

  1. Update Slim Jetpack to a release newer than 2.7.0.1 once the vendor publishes a fix. Check the plugin page for a patched version.
  2. If no fix is available, deactivate and remove the plugin.
  3. Review stored contact-field submissions for script tags or unexpected HTML, and clean any found.
  4. Consider a WAF rule to filter script content in form fields, and enforce a restrictive Content Security Policy.

References