Security readout for executives and security teams
Plain-English summary
This vulnerability affects the Subitem AL Slider WordPress plugin up to version 1.0.0. An attacker could craft a link that runs script in a victim’s browser if the victim clicks it. Business impact is usually limited, but it can support phishing, session abuse, or malicious actions in an authenticated user’s browser.
Executive priority
Treat as a routine but timely web risk. Prioritize public WordPress sites and sites used by administrators or customers. Remediate during the next maintenance cycle unless the plugin is business-critical and heavily exposed.
Technical view
CVE-2026-1634 is reflected cross-site scripting in Subitem AL Slider for WordPress via $_SERVER['PHP_SELF']. Insufficient sanitization and output escaping can allow unauthenticated injection of web script, requiring user interaction. CVSS is 6.1, CWE-79, with low confidentiality and integrity impact and no availability impact.
Likely exposure
Exposure is limited to WordPress sites with the Subitem AL Slider plugin installed, particularly versions up to and including 1.0.0 per the CVE description. The provided affected-version metadata is inconsistent, so confirm installed plugin presence and version directly.
Exploitation context
The vulnerability is network-reachable and unauthenticated, but exploitation requires tricking a user into clicking a crafted link. The source bundle does not indicate CISA KEV listing or active exploitation in the wild.
Researcher notes
Sources identify reflected XSS through PHP_SELF in templates/tab1_block1.tpl at line 11. The CVE states all versions through 1.0.0 are affected, while the structured affected field appears incomplete or inconsistent. No exploit code, patch confirmation, or active exploitation evidence is included in the provided bundle.
Mitigation direction
- Identify whether Subitem AL Slider is installed on any WordPress site.
- Check the plugin page and vendor guidance for an updated fixed version.
- Disable or remove the plugin if it is unused or no fix is available.
- Apply standard WordPress hardening and least-privilege controls for administrator accounts.
Validation and detection
- Inventory WordPress plugins across managed sites.
- Confirm Subitem AL Slider version on each affected WordPress instance.
- Review the referenced template line for unsafe PHP_SELF output handling.
- Monitor web and security logs for suspicious crafted requests to plugin pages.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1634 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N2.82.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.1MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4bfeff72-27de-46a9-b947-f60255b5d062?source=cveCVE reference
- https://wordpress.org/plugins/subitem-al-slider/CVE reference
- https://plugins.trac.wordpress.org/browser/subitem-al-slider/trunk/templates/tab1_block1.tpl#L11CVE reference
- https://plugins.trac.wordpress.org/browser/subitem-al-slider/tags/1.0.0/templates/tab1_block1.tpl#L11CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.