Executive brief
The Content Slideshow plugin for WordPress, which allows users to create and display image or content carousels, contains a security flaw. This vulnerability allows users with basic contributor-level access to embed malicious scripts into website pages. When other visitors or administrators view these pages, the scripts can execute, potentially leading to unauthorized actions or the theft of sensitive session information.
Technical details
The Content Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on shortcode attributes. The flaw exists in the slideshow-widget-shortcode.php component. An authenticated attacker with contributor-level permissions or higher can inject arbitrary web scripts into a page via a shortcode. Because the script is stored on the server, it executes in the browser of any user who visits the affected page. This can be used to hijack administrative sessions or perform actions on behalf of other users. The vulnerability affects all versions up to and including 2.4.1.
Affected products
- WordPress Content Slideshow Up to, and including, 2.4.1
Timeline
- 2026-05-27: disclosed: Initial disclosure by Wordfence and NVD publication.
References
- https://plugins.trac.wordpress.org/browser/content-slideshow/tags/2.4.1/slideshow-widget-shortcode.php
- https://plugins.trac.wordpress.org/browser/content-slideshow/tags/2.4.1/slideshow-widget-shortcode.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9548f647-9fcb-481c-874e-0184609283fe?source=cve