Vulnerability in Slideshow Gallery LITE Plugin for WordPress Allows Cross-Site Scripting
CVE-2026-2021

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Slideshow Gallery Lite
Vendor
CVE Published:
18 June 2026

What is CVE-2026-2021?

The Slideshow Gallery LITE plugin for WordPress is affected by a vulnerability that allows for Stored Cross-Site Scripting via the 'alwaysauto' shortcode attribute. This issue arises due to inadequate input sanitization and output escaping for user-supplied attributes. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts into pages. When users access the manipulated pages, the injected scripts execute, potentially compromising user data and site integrity.

Affected Version(s)

Slideshow Gallery LITE 0 <= 1.8.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/slideshow-gall...
https://plugins.trac.wordpress.org/browser/slideshow-gall...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Athiwat Tiprasaharn
.