CVE-2026-14876

Name of the Vulnerable Software and Affected Versions Smart Slider 3 versions prior to 3.5.1.39

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the data-href parameter, which execute when a user accesses the affected page.

Recommendations Update Smart Slider 3 to version 3.5.1.39 or later. Avoid using the data-href parameter until the update is applied.