CVE-2026-32494
Published: 25 March 2026
Summary
CVE-2026-32494 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 11.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the XSS vulnerability by requiring validation and neutralization of untrusted inputs used in web page generation within the WordPress plugin.
Prevents XSS exploitation by filtering and encoding information outputs before rendering in user-facing web pages.
Requires identification, reporting, and correction of the specific flaw in the Ays Pro Image Slider plugin, including timely patching up to version 2.7.1.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS (CWE-79) with AV:N/PR:N/UI:R allows crafting malicious links that execute arbitrary JS in victim browsers upon click, directly enabling drive-by compromise of site visitors and user execution via malicious link.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Image Slider by Ays ays-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Slider by Ays: from n/a through <= 2.7.1.
Deeper analysisAI
CVE-2026-32494 is an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability, classified under CWE-79, in the Ays Pro Image Slider (ays-slider) WordPress plugin, also known as Image Slider by Ays. The issue allows exploiting incorrectly configured access control security levels and affects all versions from n/a through 2.7.1. It was published on 2026-03-25.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Unauthenticated attackers (PR:N) can exploit it remotely over the network (AV:N) with low complexity (AC:L), but it requires user interaction (UI:R), such as clicking a malicious link. Successful exploitation enables cross-site scripting with a changed scope (S:C), resulting in low impacts on confidentiality, integrity, and availability.
The Patchstack advisory provides details on this WordPress plugin vulnerability at https://patchstack.com/database/Wordpress/Plugin/ays-slider/vulnerability/wordpress-image-slider-by-ays-plugin-2-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve, including potential mitigation and patch information.
Details
- CWE(s)