Stored Cross-Site Scripting in Serious Slider Plugin for WordPress

CVE-2026-15726

What is CVE-2026-15726?

The Serious Slider plugin for WordPress has a vulnerability that allows authenticated users with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs through the 'theme' shortcode attribute, which lacks adequate input sanitization and output escaping. Attackers can exploit this vulnerability to inject arbitrary web scripts into pages. These injected scripts are executed whenever a user accesses the compromised page, potentially leading to unauthorized actions and data exposure.

References