Stored Cross-Site Scripting in Slider Bootstrap Carousel Plugin for WordPress

CVE-2026-4076

What is CVE-2026-4076?

The Slider Bootstrap Carousel plugin for WordPress presents a vulnerability through insufficient input sanitization and output escaping in the 'category' and 'template' shortcode attributes. Authenticated attackers with Contributor-level access can exploit this weakness, allowing them to inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the affected pages, posing significant risks to site integrity and user safety. The direct output of unsanitized user input into HTML attributes creates this critical security flaw that requires immediate attention.

References