Description
The Content Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-05-27
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Content Slideshow plugin for WordPress stores malicious JavaScript injected through shortcode attributes because the input is not adequately sanitized and the output is not properly escaped. An attacker who can authenticate with contributor-level privileges or higher can deliver arbitrary scripts that will execute in the browser of any user who views a page containing the affected shortcode.

Affected Systems

All versions of the Content Slideshow plugin up to and including 2.4.1 installed on any WordPress site are affected. The vulnerability is present in every build of the plugin up to this release.

Risk and Exploitability

The vulnerability has a CVSS score of 6.4, indicating medium severity. EPSS data are not available, and the flaw is not listed in the CISA KEV catalog. Because the attack requires authenticated contributor+ access, the exploitability is limited to users who already have elevated privileges, but once injected, the script runs for all other site visitors. The risk remains moderate; it is advisable to address the issue promptly rather than wait for a public exploit.

Generated by OpenCVE AI on May 27, 2026 at 07:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Content Slideshow plugin to the latest version, which contains input sanitization and output escaping fixes.
  • If immediate upgrade is not possible, restrict contributor+ and admin roles from using shortcodes that accept user input, or disable the shortcode entirely for non‑trusted users.
  • Consider removing the plugin or replacing it with a trusted alternative until the issue is patched.

Generated by OpenCVE AI on May 27, 2026 at 07:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 27 May 2026 11:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 27 May 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Celloexpressions
Celloexpressions content Slideshow
Wordpress
Wordpress wordpress
Vendors & Products Celloexpressions
Celloexpressions content Slideshow
Wordpress
Wordpress wordpress

Wed, 27 May 2026 06:30:00 +0000

Type Values Removed Values Added
Description The Content Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title Content Slideshow <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Celloexpressions Content Slideshow
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-05-27T10:34:31.750Z

Reserved: 2026-05-18T20:25:19.065Z

Link: CVE-2026-8873

cve-icon Vulnrichment

Updated: 2026-05-27T10:34:26.645Z

cve-icon NVD

Status : Received

Published: 2026-05-27T07:16:16.890

Modified: 2026-05-27T07:16:16.890

Link: CVE-2026-8873

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-27T10:07:10Z

Weaknesses