Stored Cross-Site Scripting Vulnerability in Content Slideshow Plugin for WordPress

CVE-2026-8873

What is CVE-2026-8873?

The Content Slideshow plugin for WordPress is affected by a stored cross-site scripting (XSS) vulnerability that arises from inadequate input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can exploit this flaw by injecting malicious web scripts into shortcode attributes. These scripts may execute whenever a user visits an affected page, potentially compromising site integrity and user security. Users are advised to review their installations and update to the latest secure versions to mitigate risks.

References