Stored Cross-Site Scripting Vulnerability in Slick Slider Plugin by WordPress
CVE-2026-16537
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 6 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16537?
The Slick Slider plugin for WordPress, before version 0.5.3, contains a vulnerability due to improper sanitization and escaping of a shortcode attribute value. This flaw allows users with Contributor privileges and above to conduct Stored Cross-Site Scripting attacks. When a user views the affected post, malicious scripts embedded in the attribute can execute. This poses a serious security risk, enabling attackers to manipulate content or access sensitive information.
Affected Version(s)
Slick Slider 0 < 0.5.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.