CVE-2022-29426 MEDIUM

CVE-2022-29426: WordPress Slideshow, Image Slider by 2J plugin <= 1.3.54 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Vendor 2J Slideshow Team
Product Slideshow, Image Slider by 2J (WordPress plugin)
Weakness CWE-79 · XSS
Published May 20, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Authenticated (contributor or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in 2J Slideshow Team's Slideshow, Image Slider by 2J plugin <= 1.3.54 at WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

The Slideshow, Image Slider by 2J WordPress plugin through version 1.3.54 contains a stored cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious JavaScript into the plugin's settings. When another user, including site administrators, views the affected page, the injected script executes in their browser. This can lead to unauthorized actions, data theft, or further compromise of the WordPress site.

What an attacker can do

03Attacker Capabilities

Inject malicious JavaScript that executes when other users view the plugin's settings page.

Potential impact on your site

04Site Impact

Attackers with contributor or subscriber access can compromise admin accounts or steal sensitive data via stored XSS.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WordPress account and the victim must view the affected page.

Key dates

06Disclosure timeline

May 20, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-18435 Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute CVE-2026-15950 Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute CVE-2026-65527 WordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-15100 Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute CVE-2026-17162 WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute