Stored Cross-Site Scripting in SlideShowPro SC Plugin for WordPress

CVE-2026-5767

What is CVE-2026-5767?

The SlideShowPro SC plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting (XSS). This issue arises from inadequate input sanitization and output escaping concerning user-supplied attributes in the slideShowProSC shortcode. Authenticated users with contributor-level access and above can exploit this vulnerability to inject malicious scripts into pages, which will execute when other users access the compromised pages. This poses a significant security threat, as it can lead to data theft, session hijacking, or the defacement of the affected site.

References