CVE-2026-1634

Overview

The Subitem AL Slider plugin for WordPress, version 1.0.0 and all earlier versions, is vulnerable to reflected cross-site scripting (XSS). The root cause is insufficient input sanitization and output escaping on the $_SERVER['PHP_SELF'] parameter, allowing arbitrary script injection.

Exploitation

An unauthenticated attacker can craft a malicious link containing the $_SERVER['PHP_SELF'] value modified to include JavaScript payloads. The victim must be tricked into clicking the link — no authentication or special privileges are needed, only a user interaction that triggers the reflection. The attack surface is any page where the plugin outputs the raw server variable.

Impact

Successful exploitation lets the attacker execute arbitrary web scripts in the victim's browser session. This can lead to session hijacking, defacement, credential theft, or redirection to attacker-controlled sites. The CVSS v3 base score of 6.1 (Medium) reflects the requirement for user interaction to achieve impact.

Mitigation

The plugin has been closed on the WordPress plugin directory as of February 5, 2026, citing a security issue [1]. No patched version exists; the only remediation is to remove the plugin. Administrators should verify the plugin is not present and scan for any residual malicious code.