Stored Cross-Site Scripting Vulnerability in Social Slider Feed Plugin for WordPress

CVE-2026-121519

What is CVE-2026-121519?

The Social Slider Feed plugin for WordPress is susceptible to stored cross-site scripting vulnerabilities due to inadequate input sanitization and output escaping of the 'slidespeed' parameter. This vulnerability permits authenticated attackers with subscriber-level privileges and above to inject malicious scripts into pages, which execute when users access these modified pages. Additionally, it includes a flaw where the current_user_can() check is bypassed, allowing lower-level users to manipulate feed settings and grant the attacker access to their payloads on public pageviews.

References