Executive brief
The jQuery googleslides plugin for WordPress, which allows users to display Google Slides on their websites, contains a security flaw. This vulnerability allows users with contributor-level access or higher to inject malicious scripts into website pages. When other visitors or administrators view these pages, the scripts will execute in their browsers, potentially leading to unauthorized actions or data theft.
Technical details
The jQuery googleslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the googleslides_handler() function. Specifically, user-supplied attributes such as 'userid', 'albumid', and 'authkey' are interpolated directly into single-quoted HTML attributes without using the esc_attr() function. This allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts via the 'googleslides' shortcode. These scripts are stored on the server and execute in the context of any user who views the affected page. The vulnerability exists in all versions up to and including 1.3.
Affected products
- WordPress jQuery googleslides plugin Up to and including 1.3
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory